03 / Research notebook
Questions worth testing carefully.
Experiments, limitations, and sourced lab write-ups. Articles are in Vietnamese with English abstracts.
3 articles
RESEARCH · Personal lab evidence
SQL injection: testing the boundary between data and code
This controlled experiment compares string concatenation and parameter binding in Python’s SQLite interface. Six fixtures cover normal authentication decisions, a legitimate quoted username, and two injection inputs. Both implementations query the same in-memory database. Concatenation produces three correct outcomes, one syntax error, and two authentication bypasses; parameter binding produces all six expected outcomes. These observations illustrate a code–data boundary, not a general security benchmark. The complete input set, executable source, runtime versions, and raw output are provided for reproduction.
15 Sep 2026 · 5 min read →
RESEARCH · Personal lab evidence
Alert deduplication without losing evidence
Alert deduplication can reduce repeated delivery without suppressing distinct security events, but the choice of identity key matters. This deterministic replay constructs eight unique authentication events from two agents and adds four repeated deliveries. A content-based key retains one event, while a source-identity key retains all eight and removes only the four retries. The result is a counterexample to treating identical message text as event identity. This is an offline Python experiment using synthetic Wazuh-inspired records, not a benchmark of Wazuh, a production SOC, or the existing AI-APW project.
15 Sep 2026 · 5 min read →
RESEARCH · Personal lab evidence
AI in the SOC: validating outputs before automation
This experiment evaluates a deterministic output boundary for an AI-assisted SOC workflow using eight handcrafted response fixtures. The validator enforces exact fields, source-alert binding, strict types, and a minimum priority. Six fixtures are rejected and two are accepted as advisory text. One accepted response contains a malicious instruction in its explanation, demonstrating that schema validity does not imply semantic trust. No model is queried and no action executor is present. The experiment tests application policy behavior, not prompt-injection resistance or model accuracy.
15 Sep 2026 · 5 min read →Personal lab evidence has a local run or log. Reference walkthroughs are sourced learning notes and do not claim machine completion.