Case study 03

Beyond signature-based detection

Explored the limitations of YARA-based detection and researched NodLink, a provenance-graph approach to detecting suspicious system activity.

Endpoint security
YARA
Team research

Two ways to detect

Signature rules catch what they already know. Provenance graphs look at how processes relate, which can expose a new attack by its behaviour.

My contribution

Reviewed YARA documentation and examples, studied the NodLink paper and repository, and contributed to test-case design, technical documentation and validation support.

Team contribution

A teammate led the virtual-machine setup, attack simulations and comparative demonstrations. My contribution focused on research and supporting the evaluation.

What I learned

How detection approaches differ in the evidence they use, and why a credible evaluation needs realistic test cases, suitable telemetry and a clear account of experimental limitations.

More case studies

All projects

Flutter
Flask

SilverWard: scam detection for seniors

A prototype that helps seniors check suspicious messages. I built the Flutter app and the web app, where a language model returns a scam likelihood with three plain-language reasons from a typed message or a camera image.

Read case study

Python
zxcvbn

Password strength analysis

Compared generated password samples across Bitwarden CLI, PasswordWolf and a custom Python generator, examining how length and character policy affect estimated strength.

Read case study

Security & usability
User study

Guided secure network design

Co-authored a study examining how lightweight guidance influenced participants' security and usability decisions when designing a simulated SME network.

Read case study