Mathematics & Computer Science student applying statistics to threat detection.

I work on the blue-team side of security — detection engineering, threat hunting and threat intelligence — and I like problems where math actually earns its keep: separating malicious network behavior from noise, scoring risk, correlating weak signals into campaigns.

Two of my projects sit on opposite sides of the same problem. heartbeat-hunter attacks it statistically at the network layer; detection-engineering-lab attacks it operationally at the endpoint, one tested rule at a time.

• 🎓 4th-year Mathematics & Computer Science @ Eskişehir Osmangazi University
• 🛡️ CTI Academy PRISM certified (Cyber Threat Intelligence) · Siber Vatan cybersecurity program trainee
• 📫 LinkedIn · yigit.yucel.official@gmail.com

Detects jittered command-and-control beaconing in network flow data using pure statistics — no signatures, no ML black box. Robust time-series analysis (dominant-cluster CV, MAD, Schuster periodogram), Bayesian composite scoring and graph-based campaign correlation, mapped to MITRE ATT&CK T1071 / T1573.

Evaluated on the CTU-13 botnet dataset: composite scoring improved the first-true-C2 rank in every scenario, and campaign correlation surfaced the real C2 server as rank #1 among 94 candidates in a 10-bot scenario. Ships with CI, tests, a JSON-output CLI for SIEM integration and a Streamlit dashboard.

Python pandas networkx SciPy Streamlit Zeek/NetFlow

An ongoing Wazuh + Sysmon lab where every detection follows the same loop: behavior → data source → rule → testing (positive, negative, regression) → lessons learned. Rules are tested against real telemetry before they are called done, and the debugging that got them there is written down rather than tidied away.

Current coverage spans Discovery (T1087, T1033) and Persistence (T1547.001) across Sysmon Event ID 1, Event ID 13 and PowerShell Script Block Logging. The Run key detection is scoped from a measured two-hour base rate rather than assumption — a measurement that falsified two commonly repeated heuristics before either reached the rule. Includes a reproducible lab setup and a telemetry-verification procedure derived entirely from real failures.

Wazuh Sysmon PCRE2 MITRE ATT&CK Windows Event Logs

Desktop app that turns natural-language prompts into pentest commands via a local LLM (Qwen 2.5 3B / Ollama) and a two-stage intent-resolution pipeline, with a Dockerized backend orchestrating Nmap, Gobuster, Nikto and Hydra. My side: PyQt6 UI, process manager, and the security/privilege layer (pkexec, gated structured command execution, defusedxml).

Python PyQt6 Docker Ollama

4-module Windows security suite: cross-view rootkit/hidden-process detection, memory analysis, ADS detection, PII scanning (TCKN, Luhn-validated cards, IBAN) across office documents, and URL reputation via VirusTotal / URLhaus / urlscan.io — behind a weighted risk-scoring and correlation engine.

Python CustomTkinter VirusTotal API

• snort-ubuntu-setup — Snort IDS compiled from source + ClamAV; custom ICMP rules validated, EICAR signature detection confirmed.
• Cryptosteganography — LSB image steganography combined with XOR and AES encryption.

Detection & monitoring: Wazuh · Sysmon · Snort · Zeek · Wireshark · NetFlow analysis · MITRE ATT&CK Analysis: statistical & behavioral detection · detection engineering · C2/beacon hunting · threat intelligence Code: Python (pandas, networkx, PyQt6, Streamlit) · Bash · MATLAB Infra: Linux (Ubuntu, Kali) · Windows · Docker · Git · CI/CD

Currently looking for a cybersecurity internship — SOC, threat hunting, detection engineering or threat intelligence.