Write detections, then test them
Custom Snort 3 signatures and SQL detections, scored against planted attacks and benign look-alikes.
Projects 02, 06
Professional portfolio
Cyber security student who builds detections and tests them against evidence.
Third-year Bachelor of Information Technology (Cyber Security) student at Deakin University. Projects cover network forensics, purple-team detection engineering, protocol and packet analysis, and cloud log analysis.
Where I focus
Three areas, each backed by projects you can open and check.
Read the traffic itself
Packet-level work on DNS, QUIC/HTTP3, ICMP and SMB, and a threat analyser that parses pcap files.
Projects 03, 07, 01Find misconfigurations in logs
Identity, IAM and database-configuration logs, mapped to MITRE ATT&CK, with a research report on Database-as-a-Service security.
Project 06Featured projects
The three projects that best show detection, analysis and testing work. Each links to its code and written reports on GitHub.
Project 02Academic project, extended for portfolio
Purple Team Lab: Exploitation and Detection Engineering
An isolated Kali Linux (attacker and sensor) versus Windows 7 (victim) lab, built to attack a system and then detect it.
Kali LinuxSnort 3MS17-010MITRE ATT&CKpytest
github.com/Mannraj5/Project-2-Purple-Team-Lab
- Executed two attack chains in a self-owned, host-only lab: a user-execution dropper with privilege escalation, and an MS17-010 (EternalBlue-family) SMB exploit chain.
- Created and tuned 6 custom Snort 3 signatures across reconnaissance, delivery, exploitation and command-and-control, and scored detection performance for every attack phase.
- Traced two signatures that returned zero alerts to NIC offload behaviour at the capture point, where the sensor was inspecting only part of the traffic.
- Showed that a port-based C2 rule missed the same payload on a different port, while a content-based rule caught it on both.
ResultReproducible methodology with an ATT&CK-mapped write-up, a research report, and a replay and scoring harness backed by pytest.
Project 06Academic project, extended for portfolio
Cloud Security Log Analysis
SQL detections over cloud identity, IAM and database-configuration logs, built to catch common cloud database attack paths.
SQLSQLiteMITRE ATT&CKIAM logsunittest
github.com/Mannraj5/Project-6-Cloud-Security-Log-Analysis
- Generated 14 days of synthetic logs and planted three incidents: a brute-force chain ending in a public production database, a password spray, and encryption at rest disabled.
- Wrote 3 triggers and 5 batch queries mapped to MITRE ATT&CK, using SQLite.
- Found that a successful password spray is missed by per-account rules and caught by correlating sign-in failures and successes on source IP.
- Wrote a research report on securing Database-as-a-Service, using the Capital One, Snowflake-customer and Midnight Blizzard incidents as case studies.
ResultAll 9 expected alerts fired, no alerts on benign activity, and 12 of 12 tests passed.
Project 07Personal project
PCAP Threat Analyzer (pcapscope)
A packet-capture analyser using only the standard library. Reads pcap and pcapng files and decodes Ethernet, IPv4/IPv6, ARP, TCP, UDP, ICMP, DNS and SMB.
pcap / pcapngDNSSMBGitHub Actionspytest
github.com/Mannraj5/Project-7-PCAP-Threat-Analyzer
- Eight detectors run in a single pass: port scan, host sweep, C2, beaconing, SMB exploit, DNS tunnelling, ARP spoofing and cleartext credentials. A capture-health check is included.
- Found and fixed a session-tracking bug (sessions keyed on three fields instead of the full 4-tuple) and added a regression test.
- 59 synthetic-capture tests, with GitHub Actions CI on Ubuntu and Windows.
ResultValidated against six captures from the Purple Team Lab. Packet counts matched capinfos, expected attacks were detected, the baseline was clean, and a 132,727-packet scan was analysed in 2.4 s.
More projects
Earlier work across forensics, protocols, robotics simulation and web development.
Project 01Academic, extended
Network Forensics Analysis Pipeline
An end-to-end pipeline that analyses NetFlow-style flow telemetry (CIC-IDS-2017-based) for threat detection and incident investigation.
NetFlowStreamlitJupyterpytest
- Engineered forensic features and attack-pattern logic to reconstruct incidents from flow data.
- Applied unsupervised anomaly detection and supervised classification to score threats.
- Built a Streamlit dashboard for SIEM-style triage, plus Markdown reports and a pytest suite.
- Used AI coding assistants (Claude, GitHub Copilot) to build faster and learn Python patterns.
Project 03Academic, extended
Network Protocols Lab: DNS, QUIC/HTTP3 and ICMP
A packet-level investigation of three internet protocols using custom tools and Wireshark captures.
WiresharkDNSQUICICMPraw sockets
- Built a DNS timing probe across UDP, TCP, DoT and DoH (17 ms to 260 ms) and showed DNS-over-TLS still leaks the resolver hostname through TLS SNI.
- Decrypted live QUIC traffic with TLS key logs and showed a headline "HTTP/3 is 2x faster" result was mostly a DNS cache-state effect.
- Implemented ICMP echo from raw sockets, including an RFC 1071 checksum written from scratch.
Project 04Academic, extended
Robot Perception Oracle: E-Waste Disassembly Simulation
My individual contribution as the perception input for the simulation sub-team on the Redback Operations e-waste battery extraction capstone.
ROS 2 JazzyGazebo Harmonicpytest
- Replaced a placeholder with a ROS 2 (Jazzy) node reading live object poses from Gazebo Harmonic, so the motion planner and reachability checker could proceed while the vision model was still training.
- Found that batteries had fallen through the table to the floor (z = 0.050 m, not 0.81 m) because collision elements were missing.
- Bypassed the standard ros_gz_bridge, which left entity names empty, by reading Gazebo transport directly.
Result29 named objects tracked at 2.000 Hz, with a standalone pose parser covered by 25 pytest tests.
Project 05Academic, extended
Campus Events Platform (Student Plaza)
A web app that hides campus events clashing with a student's saved timetable, with a filter that shows how many events were hidden and why.
HTMLCSSJavaScriptNode test runner
- Coded the clash logic, including back-to-back events that do not clash and events contained within a class that do.
- Used vanilla HTML, CSS and JavaScript with no framework or build step, and a responsive phone-first layout.
- Prototyped verified sign-in, visible attendance and opt-in post-event group chat.
Result36 unit tests run from one table in both Node and the browser, with a parity check against the demo.
Credentials and tools
Certifications and the tools used across the projects above.
Certifications
- Google Cybersecurity Professional Certificate (v.2) Verify
- Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) Verify
- Google IT courses: Technical Support Fundamentals; Bits and Bytes of Computer Networking; Operating Systems and You; System Administration and IT Infrastructure Services; IT Security
Tools
Operating systems
Kali LinuxUbuntu LinuxWindows CMDPowerShell
Security and networking
WiresharkSnort 3Cisco Packet Tracer
Version control and testing
GitHubGitHub Actionspytest
Applied AI tools
ClaudeChatGPTGitHub CopilotGoogle GeminiMeta AI
Contact
Open to internship, part-time, contract and volunteer roles in IT, cyber security and engineering (detection, network and simulation), and to graduate roles. Available immediately.
LinkedInlinkedin.com/in/Mannraj5
GitHubgithub.com/Mannraj5