Varun Rathod·Portfolio, Vol. I

Ibuildsystems
thatthink,
defend,andadapt.

Final-year CS @ PES University · Systems, Security & AI · Ex-Research Intern @ CCNCS · Bangalore
Currently — Bangalore, INAvailable for research collaborations
Scroll to enter
© MMXXVI
On practice

An engineer with taste — building things that actually work. I care about the layer below the surface: the consensus protocol beneath the drawing board, the reward signal beneath the game agent, the correlation beneath the alert. Precision, considered — not performed.

00 — The through-line

There is one pattern across everything here: I build the thing in order to understand it. Mini-RAFT is consensus implemented from scratch across nine phases — leader election, log replication, conflict resolution, chaos-tested failover — because importing a library would have taught me nothing about why distributed agreement is hard.

It holds just as well outside distributed systems. Slither's Deep Q-Network learns Slither.io from raw 84×84 pixel frames instead of hand-fed game state, because the point was never the score — it was seeing what a reward signal alone can teach an agent to notice. Second Brain runs its own auth and rate limiting rather than bolting on a template, for the same reason: a framework can hide exactly the failure modes worth understanding.

Security work follows the identical instinct, not a separate one. SentinelX's correlation and severity-scoring layer is hand-built because configuring a SIEM to do it would hide exactly the tradeoffs worth seeing — where a rule produces noise, why stateful detection catches what stateless rules miss. The genetic-algorithm capstone pushes the same question further: malware and its detection evolving against each other across generations, to see what a detector actually learns and what it takes to break it.

I read the tools I depend on and fix what is broken in them rather than treating them as black boxes. That is the whole approach: systems that think, defend and adapt — understood at the layer below the surface, because that is the only layer where they actually fail.

01 — Section

Selected work

01Capstone · Genetic Algorithms · Adversarial ML · In Progress

Genetic Engines

Co-Evolutionary Malware Mutation & Adaptive Defense

6th-Semester Capstone, PES University

The problem

Most malware-detection research treats generation and detection as separate, static problems: samples are generated once, a model is trained once against that fixed set, and the reported accuracy holds only as long as the threat doesn't move. Real attackers and defenders don't hold still for each other. This project asked what happens when both sides are allowed to adapt — a genetic engine mutating malware against a defense engine mutating its own detection thresholds in response, across generations, instead of a single static snapshot of either.

PythonpefileNumPyDEAPPostgreSQLscikit-learn
  1. 01Co-evolutionary system pairing a Genetic Payload Mutation Engine (GPME) against a Genetic Defense Mutation Engine (GDME) — malware variants and detection thresholds evolve against each other across generations.
  2. 02Trained and evaluated against 967 benign and 931 malware PE binaries (DikeDataset) spanning ransomware, rogue security software, and banking trojan families, selected for behavioral diversity.
  3. 03Feature extraction into a 25-element numeric vector (entropy, section structure, import patterns) feeding a deterministic, family-agnostic detection engine — no hardcoded per-family logic.
  4. 04Population generation and mutation pipeline for GPME, with profile-driven mutation constraints per malware family.
Why it matters

Building GPME and GDME to run against each other — instead of training a detector once against a fixed sample set — is what made detection robustness legible: which features and thresholds hold up under adversarial pressure, and how much of a 'good' detection rate is really just a property of the threat staying still. It's a research and simulation system evaluated against DikeDataset, not a deployed AV engine — no live malware execution, no claim on catching a real-world adversary, just a testbed for how robustness holds up when the generator is allowed to fight back.

02Research · DFIR · Threat Intelligence

NarcoX

Passive CTI & Darknet Forensics Platform

Research @ CCNCS, PES University

The problem

Darknet marketplace investigations stall for the same reason every time: seizures take a market offline, the same operators re-emerge under a new name weeks later, and nothing links the two. Active infiltration is legally fraught and doesn't scale. NarcoX was built to answer the question passively — can re-emergence be established from content and infrastructure alone, with evidence a report can defend?

PythonFastAPIBERTNeo4jPostgreSQLDockerTor
  1. 01Passive dark web intelligence platform running six Docker-composed simulated .onion environments.
  2. 02BERT + spaCy NLP pipeline classifies content and extracts entities — crypto wallets, PGP keys, vendor aliases.
  3. 0315-stage concurrent DAG pipeline with ThreadPoolExecutor and cascade-safe failure handling.
  4. 04Bayesian Belief Engine fuses evidence via log-odds ratios and softmax normalization into an 8-dimensional readiness model.
  5. 05Neo4j knowledge graph clusters re-emerged marketplaces via Jaccard similarity across ASN and infrastructure fingerprints.
  6. 06MITRE ATT&CK-mapped output with auto-generated Mermaid.js traversal diagrams. Observability: Prometheus + Grafana + Loki.
Why it matters

Every conclusion the platform produces is traceable back to the artefact that caused it — a wallet reuse, a PGP key, an ASN overlap — rather than a model score with no provenance. That traceability is the whole point: it turns a hunch about a re-emerged marketplace into something an analyst can put in a report and defend.

03SOC · Blue Team · Security Engineering

SentinelX

Real-Time SOC Detection and Incident Response Platform

The problem

Most SOC learning material treats detection as a single tool producing a single alert. Real incidents don't look like that — the signal is spread across a Windows event log, a Linux auth trail, and a packet capture, and none of the three is conclusive alone. SentinelX was built to force the harder version of the problem: correlate across sources, hold state across events, and only then decide something is worth waking a human for.

PythonSecurity EngineeringSOC Simulation
  1. 01Multi-source incident response platform spanning Windows, Linux, and network log analysis.
  2. 02Real-time detection, cross-system correlation, MITRE ATT&CK mapping.
  3. 03Stateful threat detection, IOC extraction, severity scoring.
  4. 04Automated reporting through CLI, API, and an interactive dashboard.
Why it matters

Building the correlation and severity-scoring layer by hand — instead of configuring a SIEM to do it — is what made the tradeoffs legible: where a rule produces noise, why stateful detection catches what stateless rules miss, and how much of alert fatigue is a design failure rather than a volume problem.

04DFIR · Malware Analysis · Python · In Progress

Detona

Static Malware Analysis Platform

The problem

Static malware analysis tooling is usually judged on how much it extracts, not how much of that extraction survives an analyst's second look. Run a naive pipeline over a batch of PE binaries and most of what comes back is noise — common imports flagged as suspicious, benign-but-packed binaries scored the same as malicious ones, ATT&CK techniques guessed off a string match rather than behavior. Detona treats extraction as the easy half of the problem: PE parsing, YARA scanning, and entropy/packing detection are the input — the real work is the false-positive filtering that decides what an analyst should actually trust.

PythonpefileYARAMITRE ATT&CK
  1. 01Static malware analysis platform: PE parsing, YARA rule scanning, entropy and packing detection.
  2. 02MITRE ATT&CK mapping and IOC extraction with false-positive filtering.
  3. 03178-test pytest suite; fixed real bugs in pefile API usage and IOC false-positive logic during collaborative development.
05Distributed Systems · Systems Engineering

Mini-RAFT

Distributed Real-Time Drawing Board

Node.jsWebSocketDockerRAFT Consensus
  1. 01Full RAFT consensus protocol implemented from scratch across nine incremental phases.
  2. 02Leader election with randomized 500–800ms timeouts; log replication with majority quorum commits.
  3. 03Log conflict resolution, follower sync via /sync-log, periodic leader reconciliation.
  4. 04Dockerized 3-replica cluster (gateway + 3 nodes) with automated failover and chaos testing scripts.
  5. 05Uncommitted data is never broadcast — strong consistency guaranteed end-to-end.
06Full-Stack · AI · Deployed

Second Brain

AI-Powered Knowledge System

Next.js 16React 19PrismaPostgreSQLGoogle GeminiNextAuth
  1. 01Full-stack knowledge platform with AI summarisation, auto-tagging, and conversational querying via Gemini 1.5 Flash.
  2. 02JWT authentication, rate limiting, and a 9-endpoint REST API.
  3. 03Deployed live on Vercel.
07Backend · Automation · CI/CD

Price Compass

Web Scraper for Price Comparison

FlaskReactSeleniumSQLiteGitHub Actions
  1. 01Async scraper across five platforms — Amazon, Flipkart, Snapdeal, Myntra, Croma — returning results in under 15 seconds.
  2. 0223-agent rotation and proxy support for anti-bot evasion.
  3. 03CI/CD pipeline, analytics dashboard, and CSV/PDF export.
08AI/ML · Reinforcement Learning

Slither DRL

Deep Reinforcement Learning Agent for Slither.io

PyTorchDQNOpenCVGymnasium
  1. 01CNN-based Deep Q-Network trained directly on raw 84×84 pixel frames.
  2. 02100K experience replay buffer with epsilon-greedy exploration.
  3. 03400% improvement in average score over a random baseline across 500 training episodes.
02 — Section

Experience

2025 → today
Aug 2026 — Present

Teaching Assistant PES University

Supporting faculty across two courses — Software Engineering and Computer Network Security — leading lab sessions, grading, and doubt-resolution.

June 2026 — July 2026

Research Intern CCNCS, PES University

Dark web takedown research inside the Centre for Cloud, Networks and Cyber Security. The work ran end to end: standing up six Docker-composed simulated .onion environments, doing reconnaissance and vulnerability assessment against them, then simulating seizure and studying what happened after — how operators re-emerged and what traces survived the transition.

  • 01Built the forensics side of it: a BERT + spaCy pipeline for content classification and entity extraction (crypto wallets, PGP keys, vendor aliases), feeding a Neo4j graph that clusters infrastructure by similarity.
  • 02Learned that the hard part of threat intelligence isn't collection, it's provenance — an unattributable finding is not a finding. Most of the design effort went into keeping evidence traceable through every inference stage.
  • 03Output is MITRE ATT&CK-mapped intelligence reporting; the platform side of this research is NarcoX.
2025 — 2026

Tech Member Layer8

Tech member of PES University's cybersecurity club — the place most of the practical security fluency actually came from. Running CTFs and workshops rather than just competing in them changes what you have to know: you cannot set a challenge you only half understand.

  • 01Ran and supported CTF competitions and hands-on workshops on penetration testing, web exploitation, and security tooling — Burp Suite, Wireshark, Nmap.
  • 02Competition side fed straight back in: OverTheWire Bandit for Linux privilege escalation and crypto, plus IEEE hackathons and CTFs.
  • 03This is where the SOC-side interest started, and what led directly into SentinelX and the CCNCS research internship.
2025 — 2026

Club Head Equinox ECC

Organised Space Race — a 16-hour Hackathon + CTF event with 100+ participants. Conducted workshops on aerospace technology.

03 — Section

Craft

Security

15
  • Cryptography ·
  • Web Security ·
  • Network Security ·
  • OSINT ·
  • CTFs ·
  • Socket Programming ·
  • OWASP Top 10 ·
  • Burp Suite ·
  • Wireshark ·
  • Nmap ·
  • Autopsy ·
  • FTK Imager ·
  • Splunk ·
  • ELK Stack ·
  • Wazuh ·

Languages

06
  • Python ·
  • C ·
  • C++ ·
  • Java ·
  • JavaScript ·
  • R ·

Frameworks

06
  • React ·
  • Next.js ·
  • Node.js ·
  • Express ·
  • FastAPI ·
  • Flutter ·

Databases

06
  • PostgreSQL ·
  • MongoDB ·
  • Neo4j ·
  • Redis ·
  • MySQL ·
  • Prisma ORM ·

AI / ML

05
  • PyTorch ·
  • OpenCV ·
  • Gemini API ·
  • Deep Reinforcement Learning ·
  • Generative AI ·

Tools

05
  • Linux ·
  • Git ·
  • Docker ·
  • GitHub Actions ·
  • Jupyter ·
04 — Section

Credentials & competitions

  • 01MS SC-200: Security Operations Analyst AssociateIn Progress
  • 02Cybersecurity Defense Analyst — CiscoCompleted · July 2026
  • 03Introduction to Cybersecurity — CiscoJune 2024
  • 04OverTheWire Bandit — Linux privilege escalation, SSH, cryptographyCompleted · June 2025
  • 05Codefusion — 24-Hour Hackathon4th place · IEEE CTF + Hackathon · Oct 2024
  • 06Kalpana — 24-Hour HackathonTop 10 · IEEE · Feb 2025
Currently

Now

  • 01Working toward Microsoft SC-200 (Security Operations Analyst).
  • 02Running a home lab on Splunk, ELK and Wazuh — writing detections against traffic I generate myself, then trying to break them.
  • 03Extending NarcoX at CCNCS: tightening the Bayesian belief engine and the Neo4j re-emergence clustering.

05 — Contact

Let'sbuildsomething worthbuilding.

Connect

Reach out via LinkedIn or GitHub. I respond to thoughtful messages and hard problems.

Based in

Bangalore, India

Open to research collaborations and hard problems.

Varun Rathod — MMXXVISet in Fraunces & Inter