Twinkle Kamdar

Built a 5-layer real-time detection engine that catches indirect prompt injection, cross-agent collusion, and behavioral drift, attacks that bypass every standard defense. Core contribution: intent-action divergence detection using llama-3.3-70b to compare what an agent should do vs what it actually does.

Multi-layered threat detection platform combining rule-based IDS, Isolation Forest, and CICIDS2017-trained Random Forest with ensemble voting. Deployed in a Mininet SDN environment with post-quantum crypto (Dilithium3 + Kyber768), SHA-256 tamper-evident audit ledger, self-healing watchdog, NIST CSF IR automation, and Kubernetes Zero Trust.

ML-driven network microsegmentation using XGBoost and DBSCAN on UNSW-NB15. Ryu OpenFlow 1.3 on Mininet with a real-time Flask event-stream dashboard. 95.31% accuracy and 100% cross-segment block rate.

Simulated Mirai botnet attacks using Security Onion for forensic analysis. Built custom Suricata IDS rules and deep network traffic analysis using Moloch/Arkime. Delivered a comprehensive forensic report covering attack vectors, IoC extraction, and detection signatures.

Command-line tool that scans AWS environments for security misconfigurations across IAM, S3, EC2, Security Groups, and more. Generates prioritized findings with remediation steps.

Cross-platform anti-forensics detection framework for Windows and Linux. Python rule engine targeting MFT timestomping, event log manipulation, prefetch tampering, and USN journal anomalies. Streamlit/Plotly dashboard for timeline reconstruction. Published research paper.

with Kaivalya & Aarya

Kubernetes threat detection integrating Security Onion (NSM), Falco (syscall monitoring), and Filebeat. Detected container escape, privilege escalation, and lateral movement. Handled SIEM architecture and detection engineering.