The modern cybersecurity landscape is defined by asymmetric warfare. Advanced threat actors increasingly leverage automated generation tools, polymorphic code, and sophisticated evasion techniques to orchestrate large-scale campaigns. Consequently, Security Operations Centers (SOCs) remain fundamentally bottlenecked by time-intensive manual triage, severe alert fatigue, and a critical scarcity of highly specialized reverse engineers. To address this structural imbalance, we present CyberAI: an advanced Agentic Artificial Intelligence framework engineered to operate as a virtual, fully autonomous SOC analyst. Transcending the limitations of passive diagnostic sandboxes, CyberAI inherently possesses the cognitive capacity to reason, formulate hypotheses, and autonomously orchestrate over 129 specialized forensic utilities within an isolated Linux execution environment. Driven by a robust ReAct (Reason + Act) engine and seamlessly integrated with disassemblers via the Model Context Protocol (MCP), the framework conducts deep, interactive code-level inspection without human prompting. Rigorous empirical evaluations, including System Usability Scale (SUS) assessments conducted by Level 2 and Level 3 malware analysts, yielded unprecedented operational gains. The framework demonstrated a paradigm-shifting 95% reduction in time-to-triage and a 99% decrease in analytical data noise. Ultimately, CyberAI fundamentally alters the economics of cyber defense, establishing a scalable blueprint for human-machine teaming in incident response.
This project presents a portable, standalone tooldesigned for eficient cybersecurity log analysis. Byintegrating the detection engine and Sigmarules, the application enables security analysts toidentify threats locally without complex infrastructures. The platform bridges the gap betweenmassive log volumes and actionable intelligence,providing a secure, privacy-centric environment fordigital forensics and incident response (DFIR)
This project presents the design and implementation of a Real-Time Network Intrusion Prevention System (RT-NIPS) based on a machine learning methodology. The system addresses the fundamental challenge in network security: achieving both high detection accuracy and real-time processing speed simultaneously. The proposed system employs a two-level classifier architecture. Level 1 performs fast classification using Decision Tree (DT) on the first packet of each flow. Level 2 performs fine-grained analysis on low-confidence flows using Random Forest (RF) with full flow statistics. The system was trained and evaluated on two benchmark datasets: UNSW-NB15 and CICIDS2017. Key results demonstrate that the two-level approach successfully balances speed and accuracy.
SafeMailer is an intelligent email filtering gateway designed to enhance organizational security against spam messages, phishing emails, and malicious software. The project is built on a multi-layered architecture that combines sender identity verification using SPF, DKIM, and DMARC protocols, statistical classification through the Bayes classifier, attachment scanning using ClamAV, and threat similarity detection through Fuzzy Hashing. In addition, the system employs the DistilBERT model as an artificial intelligence layer for semantic analysis of email content. The system also provides an administrative web interface for monitoring results, managing policies, and retraining classifiers, which contributes to improving detection efficiency, reducing false positives, and continuously enhancing overall system performance.
ForensLink is an innovative cybersecurity project designed to detect malicious URLs using advanced artificial intelligence techniques. The project addresses one of the most widespread digital threats: URLs used in phishing attacks, malware delivery, and online fraud. The system is built around the ELECTRA Transformer model to achieve highly accurate URL classification and is integrated into a mobile application supported by a secure backend service, enabling fast and practical real-time URL analysis. What distinguishes this project is its ability to bridge academic research and real-world implementation. Rather than stopping at model evaluation, ForensLink transforms advanced detection capabilities into a usable technical solution suitable for practical deployment. The project also emphasizes security through the design of a protected URL Classifier API featuring input validation, access control, rate limiting, and monitoring mechanisms. Overall, ForensLink reflects a modern cybersecurity approach that combines intelligence, efficiency, and usability to strengthen digital protection for both individuals and organizations.
The CyberTrap project offers a new way to detect threats using cyber deception. It fixes a main problem in traditional security systems, which often cannot reliably detect complex and long-term threats. By placing misleading virtual resources called “Honeytokens,” CyberTrap provides an immediate sign when a system is breached. These tokens are designed to look like real resources to an attacker. However, as soon as they are touched or used, they send a clear and accurate alert to cybersecurity administrators, giving them valuable time to respond. The project method includes reviewing existing research, building a central management platform and a monitoring agent, and running a series of simulated attack tests. The results aim to show how this approach greatly improves threat detection, speeds up response time, and provides a scalable solution to support effective responses against a wide range of advanced and complex cyber threats.