Where AI fits
- LLM applications & security automation
- AI agents for investigation support
- RAG over security knowledge / intel
- Alert prioritization & triage
- AI-assisted malware / report analysis
- Local LLMs (Ollama) for private workflows
Cybersecurity × AI × Systems
Building secure systems, hunting threats, and applying AI to cybersecurity
Cybersecurity student and aspiring security engineer exploring the intersection of threat detection, security engineering, automation, and applied AI — still early in the journey, deliberate about where it goes.
Cybersecurity
AI Engineering
Systems
About
I'm Nguyễn Trường Bảo, a Vietnamese student at Duy Tan University (Đại học Duy Tân) majoring in Cybersecurity / Information Security, expecting to graduate in about one year. I learn primarily through labs, home labs, technical docs, and building projects — not theory alone.
My path started in networking and systems, then deepened into cybersecurity: SOC concepts, threat hunting, web and Active Directory security, and security monitoring. I'm now expanding into AI engineering — not as a pure ML researcher, but to use AI to solve real security problems: triage, automation, analysis, and detection support.
Long-term directions I care about: Security Engineer, SOC / Detection Engineer, Threat Hunter, AI Security Engineer, Automotive Cybersecurity, and Security Automation.
Learn → Build → Break → Investigate → Automate → Improve
What I'm focused on now
- SOC operations, threat hunting, and detection thinking (Elastic, Sysmon, Windows logs)
- Security automation and AI-assisted analysis (Wazuh pipelines, LLM workflows, Ollama)
- Applied AI for cybersecurity — agents, RAG, prioritization — not foundation-model research
- Automotive cybersecurity as a developing specialization
- Hands-on practice: 30+ Hack The Box labs, PortSwigger Web Security Academy
Cybersecurity Journey
One coherent path — not a random stack of tools. Each stage builds on the previous.
-
Networking
TCP/IP, VLANs, routing, ACLs, DHCP/DNS, wireless — how packets and policies actually work.
-
Systems
Linux & Windows internals: permissions, processes, services, SSH, systemd, storage, Docker, VMs.
-
Cybersecurity
Offensive foundations + defensive mindset: web security, AD, vuln assessment, monitoring concepts.
-
SOC / Threat Hunting
Elastic Stack, Kibana, Sysmon, Windows Event Logs, IOC pivoting, MITRE ATT&CK, attack-chain reconstruction.
-
Security Automation
Scripting, correlation ideas, pipelines that reduce noise and speed up analyst workflows.
-
AI Applications
LLMs, agents, RAG, local models (Ollama) applied to triage, reporting, and analysis support.
-
AI Security & Automotive
Current direction — AI Security engineering + deepening automotive cybersecurity.
AI × Cybersecurity
AI is a second pillar — not a rebrand. The goal is applied AI that improves security workflows, not isolated academic ML.
Positioning: I am not presenting myself as a pure ML researcher. I am building toward Applied AI + Cybersecurity — using AI engineering to solve real security problems.
Stack I'm exploring
Expanding via hands-on projects and practical AI training In Progress
Why this intersection matters
SOC and hunting work generate volume: events, IOCs, process trees, intel reports. Applied AI can help prioritize signals, draft structured findings, and accelerate correlation — while humans remain accountable for decisions. That's the engineering problem I'm interested in, not "AI for its own sake."
Featured Projects
Prioritized by identity fit. Status is honest: implemented, in progress, or planned. GitHub links are placeholders until repos are public.
Tier 1 — Core identity
In Progress
AI-Powered Malware Analysis Platform
Problem: Analysts need structured, explainable analysis of samples — static signals, behavior, IOCs, and ATT&CK context — not raw tool dumps.
Security platform concept combining static/dynamic analysis with AI-assisted classification, IOC extraction, MITRE ATT&CK mapping, and analyst-friendly reports.
Sample → Static → Features → Dynamic/Sandbox → AI analysis → Classification → ATT&CK → IOCs → Report
- Security: malware triage, IOC generation, ATT&CK mapping
- AI: threat classification support, structured explanations
- Status: architecture & components defined; full pipeline not claimed complete
In Progress
AI-Assisted SOC / Alert Prioritization
Problem: Alert fatigue — volume of SIEM events makes prioritization hard for early analysts.
Pipeline from Wazuh (or similar) security events through correlation and AI-assisted analysis to prioritized alerts, exposed via FastAPI with optional Telegram notifications.
Wazuh → Events → Correlation → AI analysis → Priority → FastAPI → Notify (Telegram)
- Security: detection ops, correlation, reduced noise
- AI: triage assistance, prioritization rationale
- Tech: Wazuh, Python, FastAPI, LLM, automation
Hands-on Lab
Threat Hunting — Stuxbot Investigation
Problem: Reconstruct a multi-stage attack from telemetry and intel without a single “smoking gun” alert.
Hands-on training investigation of a fictional threat actor Stuxbot: phishing → OneNote → scripted payload → PowerShell → C2 → AD recon (SharpHound) → credential activity → PsExec lateral movement. Presented as lab / training, not professional employment.
Phishing → invoice.one → OneNote → cmd/bat → PS → Pastebin → C2/Ngrok → SharpHound → PsExec
- IOC pivoting, process trees, DNS/network telemetry
- Elastic Stack / Kibana, Sysmon, Windows Event Logs, Zeek concepts
- MITRE ATT&CK mapping of the chain
Developing
Automotive Cybersecurity Lab
Problem: Vehicle-adjacent environments need segmented networks, logging, and hardened Linux/embedded stacks.
Hands-on exposure to automotive security concepts in Linux-based environments (e.g. WebOS-related stacks), firewalling, logging (ulogd2 / iptables), Raspberry Pi labs, VLANs, and segmentation. Interested in expanding into CAN, Automotive Ethernet, ECU security, UNECE R155 / ISO 21434 — not claimed as advanced expertise yet.
Notes / lab docs →Tier 2 — Security foundation
Hands-on Lab
Home Lab
Virtualized + physical lab: networking, Linux, Docker, VMs, routers, Raspberry Pi, firewalls, VLANs, and security monitoring practice.
Lab notes →
Hands-on Lab
Network Security / VLAN / Firewall Lab
Inter-VLAN routing, STP/RSTP, EtherChannel, OSPF, NAT, ACL, QoS, SNMP — CCNA-level networking applied to security segmentation and troubleshooting.
Diagrams →
Learning
Web Security / WordPress Security
Hands-on study of auth issues, access control, injection, XSS, SSRF, file-related vulns, WordPress security, CVE research, and bug bounty methodology (PortSwigger Academy + labs).
Write-ups →
Hands-on Lab
Active Directory / Windows Security Labs
Event logs, Sysmon, PowerShell logging, authentication events, lateral movement, credential attacks concepts (PsExec, SharpHound/BloodHound, DCSync concepts), always framed as lab learning.
AD notes →Tier 3 — Supporting experiments
Learning
AI Agent & RAG Experiments
Small experiments with agents, RAG, MCP-style tooling, and local models — focused on security-relevant workflows (notes search, playbook drafts, triage helpers).
Experiments →
Learning
Cloud / AWS Fundamentals
Foundational exposure to AWS concepts (e.g. EC2) for lab and security context — not claimed as production cloud architecture experience.
Notes →Security Labs & Write-ups
Hands-on learning and investigation — not certificate collecting. 30+ Hack The Box labs (Linux, Windows, networking, AD, web, defensive) plus PortSwigger Web Security Academy practice. Filter notes below or open the full blog hub.
No posts in this category yet.
Skills
Practical exposure from labs and projects — not a claim of expert-level mastery in every tag.
Defensive / SOC
Offensive / Testing
Infrastructure / Systems
AD / Windows Security
AI for Security
Programming & Tooling
Automotive (developing)
How I work
Experience & Training
Training and exposure contexts. Titles/dates use placeholders where not finalized — responsibilities are not exaggerated.
LG Electronics R&D — Automotive cybersecurity context
[DATE]
Exposure to automotive cybersecurity training/work context: embedded Linux environments, firewall configuration, logging, network security practices relevant to vehicle-adjacent systems. Exact title and scope to be filled accurately.
Fore-Z
[DATE]
Professional/training exposure (details to be completed without inventing responsibilities).
Duy Tan University (Đại học Duy Tân) — Information Security / Cybersecurity
Expected graduation ~1 year
Formal study in cybersecurity with continuous hands-on labs: networking, systems, SOC/threat hunting, web & AD security, and growing AI-for-security projects.
Vin — practical AI training
[DATE]
Expanding AI engineering capabilities with a focus on applying AI to cybersecurity workflows rather than isolated academic ML.
Learning & Progress
Honest status only. No invented certifications. “In Progress” means studying — not certified.
HTB
Hack The Box — Hands-on Labs
30+ labs across Linux, Windows, networking, Active Directory, web, and defensive security.
PSA
PortSwigger Web Security Academy
Web vulnerability learning: auth, access control, injection, XSS, SSRF, and related topics.
Net
CCNA-level Networking Knowledge
Practical networking foundation used in home lab and security segmentation work — not listed as an earned certification here.
SOC
SOC / Defensive Security & Threat Hunting
Elastic, Sysmon, Windows logs, hunting methodology, ATT&CK, CTI concepts (strategic / operational / tactical).
AI
AI Engineering · Agents · Applied Security AI
LLM apps, agents, RAG, automation for security use cases. Practical program at Vin — details TBD.
Auto
Automotive Cybersecurity
Concepts, embedded Linux, segmentation, logging; interest in CAN, Automotive Ethernet, ISO 21434 / R155 — deeper study planned.
Contact
Open to internships, security engineering / SOC / threat hunting roles, AI-for-security collaboration, and lab discussions.
Get in touch
- Email bigzero3939@gmail.com
- GitHub github.com/zewolkt3939
- LinkedIn linkedin.com/in/nguyen-truong-bao
- University Duy Tan University · Đà Nẵng, Vietnam
- Location Vietnam · Open to remote