Hi, I’m Joel

Real-Time Detection and Automated Response Framework for Malicious HTTPS Traffic Using Machine Learning and SOAR Integration

MSc thesis at Innopolis University, with Isaac Womoakor. I built the detection and explainability stack: the NFStream feature pipeline, model selection and training, and the empirically validated feature-to-ATT&CK mapping and co-developed the SOAR response layer.

Macro-averaged F1 of 0.972 on held-out data at a false-positive rate near two per cent. The feature-to-technique map rested on fourteen associations agreed by four independent lines of evidence, with bootstrap stabilities between 0.90 and 1.00.

Figures are from the MSc research evaluation. Aegis has not been deployed in an operational SOC.

Automated volatile-memory acquisition and analysis triggered from SIEM events, for malware detection and incident response.

Sole author. Built the Wazuh-triggered acquisition path with WinPMEM, Volatility3 artefact extraction, the ML classification workflow for malicious process identification, and the SOAR-oriented response scripts.

Real-time transaction analysis on Apache Kafka, applying machine learning for low-latency anomaly detection over the stream.

Sole author. Designed the end-to-end pipeline: synthetic transaction generation, the Kafka Streams topology, Random Forest inference, and live monitoring.