Independent builder / Naufal
Machine Cyber Labs brings together my cybersecurity investigations and machine learning experiments. The next direction: a SOC triage assistant that turns sanitized evidence into clear, reviewable investigation notes.
Explore the product conceptProduct direction / Concept stage
Investigators work across endpoint logs, email artifacts, and case notes. I plan to build a tool for SOC learners and small security teams to organize sanitized evidence, reconstruct timelines, and draft investigation reports with source references.
The concept builds on the investigation workflows in my public labs. The product is not yet available; the current work consists of documented labs and research prototypes.
Explore the investigation foundationSummarize sanitized log excerpts and email artifacts.
Suggest timelines and follow-up questions grounded in the supplied evidence.
Draft case notes with references and explicit uncertainty.
Keep verdicts and response decisions with the analyst.
Claude API integration is planned, not implemented. Initial validation will use synthetic or sanitized lab data. No autonomous containment is planned for the initial prototype.
The work behind the idea
Six public projects.
Methods, code, and limitations included.
Cybersecurity / Detection engineering
A Windows and Sysmon telemetry pipeline into Splunk, with seven detections covering encoded PowerShell, failed logons, persistence, and misleading email attachment extensions.
The lab is in progress. Gmail ingestion and scheduled alerts have been validated; continuous email polling has not been validated.
Cybersecurity / Incident investigation
Six training cases covering email headers and authentication, IOC extraction, attachment investigation, and evidence correlation with Splunk alerts.
Cases use authorized simulations and lab-owned accounts. Reports distinguish simulated phishing from benign training email without claiming real compromise.
Cybersecurity / Purple team
Documented SSH/SFTP investigations, EDR detection validation, controlled process termination, scoped network isolation tests, and false-positive triage.
Response exercises run on an owned VM. Documentation separates observed results, testing limitations, and capabilities that have not been implemented.
Read case SOC-L1-001Machine learning / Computer vision
A transfer learning experiment comparing ResNet50 and EfficientNetB0 across four MRI image classes, with per-class evaluation and a local web application.
A thesis research prototype. “No tumor” is a learned class; the application does not validate that an input is an MRI and has not been clinically validated for diagnosis.
Machine learning / Natural language processing
News text classification using TF-IDF, eight emotion features, and XGBoost. The Flask application supports training, evaluation, and individual or batch analysis.
Predictions do not independently verify claims. Documentation records duplicate texts across data splits that may overstate performance on unseen narratives.
Machine learning / Time series
An LSTM research application for forecasting oil closing prices using historical data and geopolitical risk indicators, with chronological splits and recorded evaluation.
Recorded metrics measure one-step predictions. They do not measure recursive seven-step forecast accuracy or establish a causal benefit from geopolitical risk.
The person behind the work
I explore cybersecurity through detection and investigation labs, and machine learning through classification and forecasting experiments.
Machine Cyber Labs is my independent project initiative and portfolio. I'm shaping the SOC assistant concept around the methods I've documented: preserve evidence, separate observations from assumptions, and make every conclusion reviewable.
Explore my GitHub