Project archive
Projects
Applied machine learning, detection engineering, memory forensics, and AI-security evaluation. Each record separates what was built, how it was evaluated, what the results show, and where the work is limited.
VADViT: Explainable Malicious-Process Detection from Memory
A Vision Transformer pipeline that converts Virtual Address Descriptor regions from Windows memory snapshots into fused Markov, entropy, and metadata images for malicious-process detection and region-level attribution.
- Python
- PyTorch
- Vision Transformer
- timm
MemTriage: Evidence-Linked Memory Analysis Workspace
A stable memory-triage workspace that connects VolMemLyzer evidence, explainable scoring, process inventory, VADViT attribution, and low-level region analysis in one investigation.
- Python
- FastAPI
- Celery
- React
Detection Under Load: Measuring Sigma Rule Robustness
An execution-based benchmark that measures published Sigma coverage for LSASS credential dumping, separates telemetry gaps from rule-logic misses, and tests how detections survive operator-controlled changes.
- Python
- Sigma
- pySigma
- Detection Engineering
Agent Under Load: Does an Agent Use the Evidence?
A LangGraph triage agent tested against controlled evidence conditions. With the alert held fixed, telemetry raised macro-F1 by 0.40 on the preregistered within-rule subset.
- Python
- LangGraph
- Agent Evaluation
- Model Evaluation
VolMemLyzer: Automated Memory-Forensics Orchestration
A modular Python toolkit over Volatility 3 for cached and parallel plugin execution, registry-driven feature extraction, normalized artifacts, and stepwise DFIR triage.
- Python
- Volatility 3
- DFIR
- Memory Forensics
MalGraph: Memory-Dump CFG Pipeline and Packing Study
A research pipeline for recovering code from process memory, building control-flow representations, and studying how packing changes what static disassembly can recover.
- Python
- SMDA
- Control-Flow Graphs
- Call Graphs