Kamal Koushik Duppalapudi

I build the layers
everything else stands on.

I write systems and security software. A transport protocol that beats QUIC on its own benchmarks, a reinforcement-learning governor for GPU clocks, a door lock that generates its own one-time passwords. Mostly the low level, and occasionally the web on top of it.

Based in
Hyderabad, India
Studying
B.Tech, IIT Hyderabad
Working on
Transport protocols and GPU power

About

Most of what I enjoy sits under the abstraction, where you can still measure what you changed.

I'm a Chemical Engineering undergraduate at IIT Hyderabad, though most of my time goes into C++, Rust, Go and Python. Transport protocols, control loops for GPU power, cryptography on small hardware. Every project here started because a benchmark or a threat model annoyed me enough to do something about it.

The other half is offensive security. I lead Kludge, IIT Hyderabad's InfoSec and Networking club. That has meant running multi-phase penetration testing and network assessment projects, designing and hosting two full CTFs across web, crypto, pwn and forensics, and a lot of hands-on sessions with the core team.

18
Core team led at Kludge
2
CTFs run end to end
150+
Participants hosted
369
of 11,517 teams, picoCTF 2024

Selected work

Eight things worth reading the source of.

Some are public, some are still private. All of them are mine end to end.

  1. 01

    Fuse

    Transport protocol · 2026

    Active

    A transport protocol I wrote on raw UDP, for the places QUIC gets in the way.

    Congestion control runs per stream instead of per connection, so a lossy bulk transfer can't throttle a telemetry stream sharing the same session. Each stream picks its own loss, ordering and coalescing policy at handshake time. Nothing allocates on the data path and the worker hot path takes no locks. On a 1 GiB checksum-verified transfer it came out 1.3 to 2.2 times faster than quinn, and latency stayed flat with 6.3 GB/s of bulk traffic running alongside.

    • C++20
    • UDP
    • GSO
    • Congestion control
    • AES-256-GCM
    FU
  2. 02

    WattWiseG

    Systems / RL · 2026

    Private

    A GPU governor that learns when it can clock your card down without costing you throughput.

    A learned power-management policy for GPUs, driven by live device telemetry and tuned to hold throughput while cutting draw. Portable across cards without per-device tuning. Proprietary, so the internals stay off this page.

    • C++
    • PyTorch
    • Reinforcement learning
    WA
  3. 03

    WattWiseC

    Systems / RL · 2026

    Private

    The same bet, taken one level further down the machine.

    A learned power policy for CPUs, sitting close enough to the hardware to act on what it sees without waiting on userspace. Trained offline, shipped as a compiled model, and left to run on its own. Proprietary, so the internals stay off this page.

    • C
    • Linux
    • Reinforcement learning
    WA
  4. 04

    Cryptographic Smart Access Control

    Embedded / security · 2025

    Deployed on-site

    A door lock that assumes the network around it is hostile.

    The ESP32 generates time-based one-time passwords with SHA-256 on a 100 second rotation, and an RTC with NTP sync keeps its clock honest through power cuts. People unlock it over BLE. A FastAPI backend on EC2 handles lock management and signs everything it sends with PGP so the lock can check where it came from, with a Raspberry Pi running the same scheme if the backend goes away.

    • ESP32
    • TOTP
    • FastAPI
    • PGP
    • BLE
    • AWS EC2
    Cryptographic Smart Access Control
  5. 05

    CrowdGuard

    Real-time vision · 2026

    Private

    Crowd analytics from the camera to the dashboard, with the model left swappable.

    A DeepStream pipeline that takes TAO, TensorRT, ONNX or Caffe models uploaded from the dashboard itself. A Go backend handles gRPC and REST telemetry ingestion, and the SvelteKit front end renders whatever metrics the pipeline sends rather than a fixed set, so adding a new one doesn't mean touching the UI.

    • DeepStream
    • Go
    • gRPC
    • SvelteKit
    • TensorRT
    CR
  6. 06

    Chemical Engineering, IIT Hyderabad

    Department website · 2026

    Live

    A full rebuild of the department's site, down to the timetables.

    Next.js and TypeScript over a real schema for faculty, courses, committees, achievements and semester timetables. The import tooling reads the spreadsheets and PDFs the department already had, so nobody had to retype years of records to get the site running.

    • Next.js
    • TypeScript
    • PostgreSQL
    • Vitest
    CH
  7. 07

    ntp-time

    CLI tool · 2025

    Released

    Accurate time from any NTP server, without leaving the terminal.

    A small Rust CLI. ISO8601, Unix seconds or milliseconds, whichever server you want, coloured output, and a copy flag that works on both Wayland and X11.

    • Rust
    • NTP
    • CLI
    NT
  8. 08

    Poker

    Full-stack game · 2026

    Playable

    Texas hold'em with friends, hand evaluation included.

    FastAPI holds the game engine, hand evaluation and table state behind token auth. React does the table itself.

    • FastAPI
    • React
    • SQLite
    • Python
    PO

Toolkit

Tools, in rough order of hours spent.

Languages

Where most of the work happens

  • C++
  • Python
  • Rust
  • Go
  • TypeScript
  • Java
  • Kotlin
  • Bash

Systems & infra

Build, ship, keep it running

  • Linux
  • Docker
  • AWS
  • Azure
  • Oracle Cloud
  • Nginx
  • Git
  • MySQL
  • ZeroMQ
  • Protobuf

Web

The layer people actually see

  • React
  • Next.js
  • Astro
  • Tailwind
  • FastAPI
  • Django
  • Node.js
  • D3.js
  • Three.js

Security

Offensive, mostly

  • Wireshark
  • Burp Suite
  • Bettercap
  • Nmap
  • Netcat
  • Hashcat
  • Aircrack-ng

Data & hardware

Numbers, and the boards they run on

  • PyTorch
  • NumPy
  • Pandas
  • SciPy
  • Matplotlib
  • Jupyter
  • ESP32
  • Arduino
  • Raspberry Pi
  • Blender
  • SolidWorks

Contact

Start a conversation.

I'm open to internships, security work, and anything that involves reading a spec closely. If you have a protocol, a device or a benchmark that is misbehaving, I'd like to hear about it.

kamalkoushik24@gmail.com
GitHub
kamalkoushikd
LinkedIn
kamal-koushik-duppalapudi
Résumé
PDF, one page
Based in Hyderabad, Telangana, India