Challenge: Cloud-native networks produce high-volume telemetry that traditional IDS cannot process in real time without expensive SIEM licensing. SMEs need a low-cost, open-source alternative.

What I built: A five-stage containerised pipeline: Zeek parses live traffic into structured JSON, Redis Streams buffers telemetry with automatic recovery, and a calibrated XGBoost model scores each flow for anomalies before a policy engine decides the response.

Outcome: 84.2% ROC-AUC on the CICIDS2017 benchmark. After calibrating for a real-world false-alarm budget, the pipeline catches 40% of attacks while keeping false positives below 9%. Every step is fully documented and reproducible on GitHub.

Problem: Router admin panels missed ephemeral IoT devices. I had no reliable inventory of what was actually on my network.

What I built: A scheduled four-stage pipeline with arp-scan discovery, nmap fingerprinting, Python CVE enrichment via NVD API, and Telegram alerting. Scanning runs in read-only, least-privilege ephemeral Docker containers.

Outcome: Full baseline in under 3 minutes with no endpoint agents. Weekly JSON diffs automatically surface new devices and vulnerable software.

Challenge: Most home labs start as convenience projects and become liabilities. Default passwords, no logging, and services exposed to the open internet create a silent attack surface.

What I built: Three isolated nodes on Linux and Raspberry Pi: a VPN-protected media hub, a hardened Nextcloud file sync stack with Caddy TLS, and an experimental automation node exposed only through Cloudflare Tunnel. Each node has its own firewall rules, least-privilege containers, and no shared credentials.

Outcome: A fully operational self-hosted cloud with documented security boundaries, encrypted SMB shares, and template-first configuration that keeps real secrets out of version control. The network reconnaissance pipeline scans this same LAN weekly and reports new devices or vulnerable software.

Challenge: Credit card portfolios lose 16% of customers to churn, yet most retention campaigns arrive too late. The bank needed a way to spot at-risk customers before they called to cancel.

What I built: A four-model comparison pipeline on 10K customer records: Logistic Regression, Decision Tree, Random Forest, and Gradient Boosting. Applied SMOTE to fix class imbalance, Grid Search for hyperparameter tuning, and evaluated each model on churn recall rather than overall accuracy.

Outcome: Gradient Boosting Machine achieved 97% accuracy and 89% churn recall after tuning. The model correctly identifies 9 out of 10 customers who actually leave, giving the retention team a ranked list to act on instead of blanket campaigns.