I created Cyber Actor Atlas as an open-source map and downloadable dataset for exploring the publicly reported origins of cyber actors. It is designed as a lightweight research and education resource for people who want a clearer geographic view of how named actors are described in public reporting.

The atlas brings together cybercrime groups, financial fraud actors, crypto-crime actors, darknet market operators, hacktivist collectives, state-linked theft groups, access brokers, and a limited set of defensive or white-hat organizations for context.

I created NowEDA (Python Library) as an open-source data analysis tool designed to make exploratory data analysis simple and accessible. Many software engineers and cybersecurity analysts work with data every day but are not specialists in data analysis, which can make initial exploration slow and inconsistent.

NowEDA provides a lightweight interface built on top of DataFrames, allowing users to quickly load datasets and generate summaries, insights, and data quality scores. It also includes a modular plugin system to detect patterns such as missing data, outliers, encoded fields, and potential sensitive information, helping users understand their data faster with minimal effort.

I created this research project to explore whether graph-based anomaly detection can improve the identification of post-compromise lateral movement in enterprise authentication logs.

The study uses 180,000 synthetic authentication events across 30 days, including 498 users, 150 hosts, and 16,391 labeled attack chains aligned with MITRE ATT&CK T1078 and T1021. I compared a simple rule-based baseline with a graph-based model using edge novelty, path rarity, and host degree deviation.

The graph-based method achieved higher precision and recall while reducing the false-positive rate. The repository includes the analysis notebook, dataset documentation, results, research poster.

I contribute to open-source projects across Python, data analytics, cybersecurity, developer tooling, and technical documentation.

• OpenCTI-Platform/opencti — Improved OpenCTI documentation and Python client examples across data ingestion, STIX object handling, storage performance, and observable creation workflows.
  PRs: #17460 (approved), #17482 (open), #17483 (open), #17484 (open)

• conda/conda — Updated Conda documentation across package specifications, environment management, shell activation, authenticated channels, channel concepts, and command-line usage.
  PRs: #16465 (merged), #16476 (merged), #16478 (open), #16483 (open), #16484 (open), #16485 (open)

• docker/docs — Clarified Docker documentation related to container restart behavior, NVIDIA GPU access, and OCI and Docker exporter output formats.
  PRs: #25689 (open), #25690 (open), #25698 (open)

• pypi/warehouse — Improved PyPI documentation covering organization accounts, API token authentication, Twine credential handling, keyring integration, and Trusted Publishing.
  PRs: #20346 (merged), #20352 (open)

• osirislab/ctf101 — Improved the CTF 101 documentation site through frontend readability fixes and analytics integration.
  PRs: #66 (merged), #70 (open)

• apache/superset — Contributed a fix for SQL generation involving numeric IN filters with mixed integer and decimal values.
  PR: #42625 (open)

• apache/airflow — Expanded logging architecture documentation with clearer coverage of default loggers and related task and advanced logging resources.
  PR: #70842 (open)

• elastic/kibana — Improved Security Solution API documentation by clarifying the risks of deleting exception lists that remain linked to detection rules.
  PR: #282198 (open)

• jupyterlab/jupyterlab — Improved extension development documentation by explaining how to build theme-aware CSS using JupyterLab variables instead of hard-coded colors.
  PR: #19230 (open)

• OWASP/CheatSheetSeries — Improved language consistency and US English usage across multiple OWASP security cheat sheets.
  PR: #2316 (merged), #2333 (open), #2334 (open)

• NYU OSIRIS Lab — Contributed to private research lab repositories supporting cybersecurity research, CTF infrastructure, AI evaluation workflows, Official NYU tooling, and internal lab tooling.
• NYUSEC Team - Competitor on the NYU Security CTF Team on CTF Time.