Key Takeaways
- Dr. Kevin Hamlen aims to train students who can both mathematically prove software security and uncover real‑world vulnerabilities.
- Doctoral candidate Charles Averill (BS ’23) excels at both, earning recognition for his work on timing‑side‑channel defenses.
- Averill devised a mathematically verified method to detect and prove the absence of timing vulnerabilities, a problem that had eluded experts for decades.
- His solution won first place in the graduate student category of the 2026 ACM Student Research Competition Grand Finals.
- The research is part of a DARPA‑funded V‑SPELLS project that seeks to modernize legacy software safely through formal, piece‑wise verification.
- Collaborators from UT Dallas, Georgia Tech, and Trusted Science & Technology highlight the broader impact of Averill’s contribution to securing critical infrastructure.
Dr. Hamlen’s Vision and Averill’s Dual Expertise
Dr. Kevin Hamlen, the Louis Beecherl Jr. Distinguished Professor of Computer Science at the University of Texas at Dallas, has long advocated for a dual‑skill approach in cybersecurity education: the ability to reason mathematically about software correctness paired with hands‑on programming talent to discover exploitable flaws. He observes that most students gravitate toward one side—either excelling in formal proof or in vulnerability hunting—but rarely both. When Hamlen first taught Charles Averill, he recognized an exceptional blend of these abilities and encouraged the undergraduate to pursue doctoral studies, convinced that Averill could become one of the rare few who master the full spectrum of modern security research.
Early Exposure to Formal Methods and Averill’s Passion
Averill’s journey into formal methods began in Hamlen’s undergraduate lab, where he was assigned to read a dense textbook on the subject and solve its challenging problems. The experience sparked an immediate fascination; Averill described the field as “ridiculously interesting, fun, and addictive.” This early immersion solidified his commitment to formal methods, a discipline that uses mathematical logic to prove that software adheres to specified security properties. The rigorous training laid the groundwork for his later breakthroughs in timing‑side‑channel analysis, proving that a strong theoretical foundation can translate into practical security tools.
Development of a Mathematically Verified Timing‑Vulnerability Detector
As a graduate student, Averill tackled a longstanding problem: detecting timing vulnerabilities that could leak secrets such as encryption keys through variations in execution time. Traditional testing approaches often miss subtle side‑channels, while pure formal methods struggled to scale to real‑world binaries. Averill devised a mathematically verified technique that models the binary‑level execution timing of programs and formally proves the absence of exploitable timing leaks. By bridging the gap between abstract proof and concrete code analysis, his method provides a deployable assurance that timing‑sensitive software—critical in aerospace, finance, and infrastructure—can be hardened against sophisticated attacks.
Recognition at the ACM Student Research Competition Grand Finals
The significance of Averill’s contribution was affirmed when he earned first place in the graduate student category of the 2026 Association for Computing Machinery (ACM) Student Research Competition Grand Finals. The competition, which drew over 340 participants from worldwide ACM conferences throughout the academic year, culminated in a final showcase of the most innovative student research. Averill’s victory followed an earlier first‑place win at the ACM SIGPLAN Conference on Programming Language Design and Implementation, which qualified him for the grand finals. He expressed disbelief followed by profound pride upon receiving the award, crediting the honor to the support of his advisors and collaborators.
Averill’s Reaction and Ongoing Professional Development
Reflecting on the accolade, Averill noted, “I’m incredibly honored to receive an ACM Student Research Competition Grand Finals award. When I got the news, I had about 10 minutes of disbelief and after that, I felt a huge sense of pride. I felt very lucky and grateful for this honor.” At the time of the award, he was completing a summer internship at Riverside Research, a nonprofit in Lexington, Massachusetts, that focuses on national security challenges. The internship allowed him to apply his formal‑methods expertise to real‑world defense projects, further reinforcing the practical relevance of his academic work.
Hamlen’s Praise and the Award’s Prestige
Dr. Hamlen lauded the achievement as one of the most prestigious honors available for student research across the entire computer science discipline. He emphasized that Averill’s success exemplifies the ideal outcome of his educational philosophy: a scholar who can both reason rigorously about security and engineer effective solutions. Hamlen noted that the award not only highlights individual talent but also underscores the value of the collaborative research environment cultivated in his lab, where theoretical depth and practical experimentation coexist.
Collaborative Effort Behind the Breakthrough
Although the ACM award recognizes Averill’s personal contributions, he was quick to stress that the research emerged from a team effort. The work involved numerous peers in Hamlen’s lab, as well as collaborators at Dartmouth College, where Averill also receives guidance from Dr. Cristophe Hauser, an assistant professor of computer science. This multidisciplinary partnership enabled the integration of diverse perspectives—ranging from low‑level binary analysis to high‑level formal verification—resulting in a solution that is both theoretically sound and practically applicable.
Averill’s Academic Trajectory and Leadership Experience
Originally from Houston, Averill entered UT Dallas with interests in artificial intelligence and its application to robotics. His focus shifted after joining the student‑led Computer Security Group, where he eventually served as president, gaining leadership experience and deepening his fascination with low‑level software and binary analysis. This pivot from AI‑robotics to security exemplifies how exposure to research groups and mentorship can redirect a student’s trajectory toward impactful, high‑demand fields such as cybersecurity.
DARPA V‑SPELLS Collaboration and Future Impact
Averill’s timing‑vulnerability research is a critical component of the Defense Advanced Research Projects Agency’s (DARPA) Verified Security and Performance Enhancement of Large Legacy Software (V‑SPELLS) program. The initiative seeks to enable safe modernization of aging software systems without requiring complete rewrites, thereby reducing security risks and operational disruptions. By providing formally verified assurances that new code will interact correctly with legacy binaries, Averill’s method supports a piece‑wise, trustworthy upgrade path for critical infrastructure. Dr. Brendan Saltaformaggio of Georgia Tech, the project’s lead principal investigator, praised Averill’s work as advancing the fundamental science of binary‑level formal analysis, while Dr. Jason Li of Trusted Science & Technology highlighted how the breakthrough underpins V‑SPELLS’ goal of delivering secure, incremental software modernization.
Conclusion: Advancing Security Through Rigorous, Practical Research
Charles Averill’s journey—from undergraduate fascination with formal methods to award‑winning developer of a verified timing‑side‑channel detector—illustrates the power of combining mathematical rigor with hands‑on cybersecurity expertise. His contributions, recognized by the ACM Student Research Competition Grand Finals and embedded within a strategic DARPA partnership, promise to enhance the security and reliability of timing‑sensitive systems across aerospace, energy, finance, and other vital sectors. As the V‑SPELLS effort progresses, Averill’s work stands as a model for how academia can produce deployable, provably secure solutions that address real‑world threats.