Portfolio

Challenge

Unidentified IoT device on home network exhibiting suspicious command-and-control (C2) behavior with potential data exfiltration.

Approach

Deployed ntopng network traffic monitoring platform to analyze real-time packet flows, identify malicious communication patterns, and map device behavior to MITRE ATT&CK framework tactics.

Solution

• Configured ntopng for deep packet inspection on network gateway
• Identified IoT device communicating with suspicious external IPs in China
• Mapped behavior to MITRE ATT&CK T1071 (Application Layer Protocol) and T1041 (Exfiltration Over C2 Channel)
• Isolated compromised device using network segmentation (VLAN)
• Created firewall rules blocking unauthorized connections
• Implemented ongoing monitoring with automated alerting

Challenge

Home lab infrastructure lacked centralized security monitoring, log aggregation, and incident detection capabilities across multiple endpoints and virtualized environments.

Approach

Deployed Wazuh SIEM platform to provide real-time security monitoring, log analysis, and compliance reporting for virtualized environment running on Proxmox.

Solution

• Installed Wazuh Manager, Indexer, and Dashboard on Ubuntu 25.10 server
• Deployed Wazuh agents on multiple endpoints (Kali Linux, Parrot Security, Ubuntu)
• Configured custom security rules for SSH brute force detection
• Implemented privilege escalation monitoring
• Integrated syslog collection from network devices
• Created alerting workflows for critical security events
• Configured compliance monitoring (PCI-DSS, GDPR frameworks)

Challenge

Build professional cybersecurity testing environment supporting offensive/defensive security research, vulnerability analysis, and continuous skill development.

Solution

• Deployed Proxmox VE hypervisor on bare-metal server
• Configured multiple VMs: Kali Linux (penetration testing), Ubuntu Server (services), Parrot Security (OSINT/forensics)
• Implemented network segmentation with VLANs for isolated testing environments
• Deployed Docker containers: ntopng (network monitoring), Pi-hole (DNS filtering), Plex (media server)
• Integrated Snort IDS for network intrusion detection
• Configured Wazuh agents for endpoint monitoring
• Established secure remote access via WireGuard VPN

Challenge

Modern cybersecurity requires rapid research, code analysis, and documentation. Build AI-integrated security workstation to enhance efficiency without compromising operational security.

Solution

• Integrated Claude Code (Anthropic) for code analysis and documentation
• Deployed Google Gemini API for threat intelligence research
• Configured Ollama (local LLM) for offline analysis of sensitive data
• Built custom workflows on Parrot Security OS
• Implemented air-gapped analysis environment for sensitive operations
• Created documentation templates for security assessments