This project presents a portable, standalone tooldesigned for eficient cybersecurity log analysis. Byintegrating the detection engine and Sigmarules, the application enables security analysts toidentify threats locally without complex infrastructures. The platform bridges the gap betweenmassive log volumes and actionable intelligence,providing a secure, privacy-centric environment fordigital forensics and incident response (DFIR)
This project presents the design and implementation of a Real-Time Network Intrusion Prevention System (RT-NIPS) based on a machine learning methodology. The system addresses the fundamental challenge in network security: achieving both high detection accuracy and real-time processing speed simultaneously. The proposed system employs a two-level classifier architecture. Level 1 performs fast classification using Decision Tree (DT) on the first packet of each flow. Level 2 performs fine-grained analysis on low-confidence flows using Random Forest (RF) with full flow statistics. The system was trained and evaluated on two benchmark datasets: UNSW-NB15 and CICIDS2017. Key results demonstrate that the two-level approach successfully balances speed and accuracy.
SafeMailer is an intelligent email filtering gateway designed to enhance organizational security against spam messages, phishing emails, and malicious software. The project is built on a multi-layered architecture that combines sender identity verification using SPF, DKIM, and DMARC protocols, statistical classification through the Bayes classifier, attachment scanning using ClamAV, and threat similarity detection through Fuzzy Hashing. In addition, the system employs the DistilBERT model as an artificial intelligence layer for semantic analysis of email content. The system also provides an administrative web interface for monitoring results, managing policies, and retraining classifiers, which contributes to improving detection efficiency, reducing false positives, and continuously enhancing overall system performance.
ForensLink is an innovative cybersecurity project designed to detect malicious URLs using advanced artificial intelligence techniques. The project addresses one of the most widespread digital threats: URLs used in phishing attacks, malware delivery, and online fraud. The system is built around the ELECTRA Transformer model to achieve highly accurate URL classification and is integrated into a mobile application supported by a secure backend service, enabling fast and practical real-time URL analysis. What distinguishes this project is its ability to bridge academic research and real-world implementation. Rather than stopping at model evaluation, ForensLink transforms advanced detection capabilities into a usable technical solution suitable for practical deployment. The project also emphasizes security through the design of a protected URL Classifier API featuring input validation, access control, rate limiting, and monitoring mechanisms. Overall, ForensLink reflects a modern cybersecurity approach that combines intelligence, efficiency, and usability to strengthen digital protection for both individuals and organizations.
The CyberTrap project offers a new way to detect threats using cyber deception. It fixes a main problem in traditional security systems, which often cannot reliably detect complex and long-term threats. By placing misleading virtual resources called “Honeytokens,” CyberTrap provides an immediate sign when a system is breached. These tokens are designed to look like real resources to an attacker. However, as soon as they are touched or used, they send a clear and accurate alert to cybersecurity administrators, giving them valuable time to respond. The project method includes reviewing existing research, building a central management platform and a monitoring agent, and running a series of simulated attack tests. The results aim to show how this approach greatly improves threat detection, speeds up response time, and provides a scalable solution to support effective responses against a wide range of advanced and complex cyber threats.
IntelliGuard, an Android application powered by a custom AI model designed for high-precision detection. The team initially trained a sophisticated model on over 11,000 real-world apps—both malicious and benign—achieving a 94% accuracy rate in distinguishing safe software from suspicious threats. The true technical achievement, however, lies in compressing this massive intelligence into a microscopic model of less than 400 KB that runs entirely on the device without internet access or data transmission to external servers, completing scans in under a tenth of a second. Unlike traditional antivirus tools that rely on static blacklists of known signatures, IntelliGuard identifies “Zero-Day” attacks by focusing on behavior rather than identity; it analyzes 229 different indicators to determine how an app acts, allowing it to catch brand-new threats unrecognized by any global database. Furthermore, the project overcomes a major academic hurdle by functioning on standard Android devices without requiring “Rooting,” meaning it provides seamless, background protection for the average user without compromising privacy or requiring dangerous system modifications.
The project focuses on detecting network-based intrusions by building an intelligent model capable of detecting attacks and suspicious activities, along with analyzing the most important features that play a key role in identifying intrusion attempts, thereby enhancing detection efficiency and the accuracy of security decision-making.