# Information Security Education & Awareness (ISEA)
**Role:** Cyber Security & Generative AI Intern
**Location:** Ahmedabad, Gujarat, India
**Date:** Jan 2026 – Feb 2026
**Duration:** 2 Months
**Links:**
- Research Paper: [Read Paper](https://drive.google.com/file/d/14JL-GAlhsqsMu4cFh4uNuT4BMBfVN07w/view?usp=sharing)
## Overview
Built an end-to-end cybersecurity pipeline for raw log ingestion, sessionization, hybrid anomaly detection and MITRE ATT&CK mapping using RAG (Retrieval-Augmented Generation) architecture. The pipeline converts raw logs into structured session intelligence and maps suspicious sessions to MITRE ATT&CK techniques, delivering explainable results to security analysts.
## Key Highlights
- Built a cybersecurity analytics pipeline with hybrid anomaly detection (rule-based + Isolation Forest/LOF) achieving 0.91 weighted F1-score for parsing and sessionizing raw security log data.
- Created a RAG-based workflow using Hugging Face embeddings and Qdrant to map suspicious sessions to MITRE ATT&CK techniques and tactics.
- Delivered explainable results to analysts including IP-to-technique mapping, confidence-based reporting and visualizations via Jupyter notebooks.
- Processed raw security logs through 9-phase pipeline from ingestion to final analyst-facing reports.
- Published research paper documenting the methodology and results.
## Tech Stack
Python 3.10+ | Qdrant (Vector Database) | Hugging Face Embeddings | Isolation Forest / LOF | MITRE ATT&CK STIX | Docker | Jupyter Notebooks | Pandas, NumPy, Scikit-learn | Matplotlib, Seaborn
## Pipeline Architecture
The project implements a 9-phase end-to-end pipeline for cybersecurity log analysis and threat detection:
### Phase 1-3: Data Processing & Detection
- Ingested raw log files and parsed into structured events using custom parsers
- Enriched events with additional context and sessionized with configurable time gaps (600s) and minimum events (2)
- Applied rule-based detection combined with Isolation Forest/LOF for anomaly scoring
- Achieved 0.91 weighted F1-score using hybrid detection approach
### Phase 4-6: RAG & ATT&CK Mapping
- Downloaded MITRE ATT&CK STIX data and built structured cache with technique indexes
- Created Qdrant vector database with embedded ATT&CK techniques and scored sessions
- Implemented semantic retrieval to map suspicious sessions to relevant ATT&CK techniques
- Generated session-to-ATT&CK mapping with confidence scores and top-3 technique matches
### Phase 7-9: Evaluation & Reporting
- Generated manual label templates for detection and mapping evaluation
- Evaluated pipeline performance using proxy and labeled modes with detailed metrics
- Produced final analyst-facing summaries with source IP to tactic-technique mappings
- Created visualizations including top tactics, techniques and embedding model comparisons
## Key Achievements
- **Detection Performance:** Achieved 0.91 weighted F1-score using hybrid anomaly detection combining rule-based rules with Isolation Forest and LOF algorithms.
- **RAG Implementation:** Successfully implemented semantic search using Hugging Face embeddings and Qdrant to map suspicious sessions to MITRE ATT&CK techniques.
- **Analyst-Facing Outputs:** Delivered comprehensive reports including IP-to-technique mapping, confidence-based reporting, and visual analytics.
- **Research Contribution:** Authored research paper documenting the methodology, results, and implications for cybersecurity analytics.
- **Scalable Pipeline:** Designed a modular, CLI-driven pipeline that can process large-scale security logs and produce reproducible results.
---