📍 Sydney, Australia 🇦🇺

I am a Cybersecurity graduate student specializing in Security Operations (SOC), Detection Engineering, SIEM, and Blue Team Security. I build hands-on security labs that simulate real-world attacks, validate detections, and strengthen defensive capabilities through practical experimentation.

My work combines SIEM engineering, network security, incident response, and machine learning to create reproducible cybersecurity projects that mirror enterprise Security Operations Centers. Every project focuses on detection accuracy, evidence collection, MITRE ATT&CK mapping, and continuous improvement.

• 🛡️ Building enterprise-style SOC detection engineering labs
• 📈 Developing custom Wazuh detection rules
• ☁️ Learning Microsoft Sentinel
• 🔬 Publishing practical cybersecurity research
• 💼 Preparing for SOC Analyst & Detection Engineer roles

Repository

➡️ https://github.com/MrBipinShrestha/soc-home-lab-wazuh

Enterprise-style SOC lab simulating real-world cyber attacks, endpoint monitoring, threat detection, and incident response.

• Multi-agent endpoint monitoring
• Five realistic attack simulations
• SSH brute force detection
• Privilege escalation detection
• Malware persistence analysis
• Data exfiltration monitoring
• Cron backdoor investigation
• MITRE ATT&CK mapping
• Detection engineering validation
• Five professional incident response reports

• ✅ 3/5 attack scenarios automatically detected
• ✅ 2 detection gaps documented
• ✅ Detection improvements recommended

Technology

Wazuh • Linux • Windows • MITRE ATT&CK • SIEM

Repository

➡️ https://github.com/MrBipinShrestha/network-anomaly-detection-unsw-nb15

Machine learning pipeline for detecting malicious network traffic using the UNSW-NB15 benchmark dataset.

• Seven-stage ML pipeline
• Feature engineering
• Label encoding
• Z-score normalization
• SMOTE balancing
• Isolation Forest anomaly detection
• Random Forest classification
• Performance evaluation
• Reproducible Jupyter workflow

Top predictive features

• ct_state_ttl
• sttl
• rate
• sload
• dload

Machine Learning-Driven Network Anomaly Detection: An Empirical Study Using Isolation Forest and Random Forest on the UNSW-NB15 Benchmark

Published in:

Australian Journal of Wireless Technologies, Mobility and Security

https://ausjournal.com/index.php/j/article/view/92

Technology

Python • scikit-learn • SMOTE • Pandas • Jupyter

Repository

➡️ https://github.com/MrBipinShrestha/phishing-attack-lab-kit

SOC-focused phishing investigation framework covering email analysis, OSINT, threat intelligence, detection engineering, and prevention.

• Email header analysis
• SPF, DKIM & DMARC validation
• Domain reputation analysis
• Typosquatting detection
• WHOIS investigation
• VirusTotal integration
• MXToolbox analysis
• MITRE ATT&CK mapping
• Detection recommendations
• Five practical investigation labs

Technology

Python • VirusTotal • WHOIS • MXToolbox • Wazuh

Machine Learning-Driven Network Anomaly Detection: An Empirical Study Using Isolation Forest and Random Forest on the UNSW-NB15 Benchmark

Australian Journal of Wireless Technologies, Mobility and Security

• 📖 Journal: https://ausjournal.com/index.php/j/article/view/92
• 🎓 Google Scholar
• 🆔 ORCID: https://orcid.org/0009-0004-2734-1646

• Wazuh
• Security Monitoring
• Detection Engineering
• Log Analysis
• Threat Detection
• MITRE ATT&CK

• TCP/IP
• DNS
• HTTP / HTTPS
• SSH
• Packet Analysis
• Wireshark

• Threat Investigation
• IOC Analysis
• Root Cause Analysis
• Incident Documentation
• Digital Forensics

• Python
• Pandas
• NumPy
• scikit-learn
• Jupyter Notebook

• Linux
• Windows

• VirusTotal
• WHOIS
• MXToolbox
• ClamAV
• Git
• GitHub

• Cisco Introduction to Cybersecurity
• Cisco Cyber Threat Management
• Cisco Endpoint Security
• Fortinet Certified Associate (remove if not completed)

I believe effective security comes from validating detections through practical testing—not assuming coverage.

Every project follows the same engineering workflow:

Attack
   ↓
Detect
   ↓
Investigate
   ↓
Respond
   ↓
Document
   ↓
Improve Detection

Every published lab includes:

• Attack simulation
• Detection validation
• MITRE ATT&CK mapping
• Evidence collection
• Incident reporting
• Gap analysis
• Detection improvement recommendations

I'm actively seeking opportunities in:

• SOC Analyst
• Detection Engineer
• Blue Team Security
• Security Operations Center (SOC)
• Incident Response

I enjoy collaborating on cybersecurity projects, SIEM engineering, threat detection, and security research.

• 💼 LinkedIn: https://www.linkedin.com/in/shresthabin/
• 💻 GitHub: https://github.com/MrBipinShrestha
• 🆔 ORCID: https://orcid.org/0009-0004-2734-1646

⭐ If you find my work useful, feel free to star my repositories or connect with me on LinkedIn!