> ls ~/lab-notes
blog
Lab notes and write-ups: what I built, how I attacked it, how I defended it, and what broke along the way.
-
A Windows 11 forensics case, and an AI agent for triage
A course forensics case on an encrypted Windows 11 VM: handling the evidence, mapping the findings to MITRE ATT&CK, and what an LLM agent can and cannot do for triage.
-
Designing a secure smart-city IoT architecture
A layered edge-to-cloud design for city cameras, traffic sensors and street lighting, and the controls that keep one hacked lamp post from reaching the rest.
-
Madrid air quality: clustering, classification and transfer learning
A team project on Madrid air-quality data: K-Means against DBSCAN, SVM against Naive Bayes, and a small neural network that behaved better with transfer learning.
-
A network log analysis agent that keeps the evidence in-house
Detecting beaconing, DNS tunnelling, lateral movement and exfiltration in network logs with plain statistics, then letting a small local LLM write the summary.
-
A motion and comfort sensor app, with replay protection
A team project for an IoT security course: recognising posture and falls from an accelerometer, a heat-index comfort reading, and a nonce against replayed messages.
-
I audited my own password manager, then rewrote it
Good primitives are not a secure system. What a security audit of my own Python password manager found, how version 2 is designed, and five bugs that only appeared when I ran it.