[Network Security Monitoring Tool]
- First Place at UNH Undergraduate Research ConferenceNetwork Behavior is a cybersecurity monitoring tool I built with three teammates as my senior capstone at UNH. The CS department's IT team was drowning in alerts. Everyday, millions of lines of Palo Alto firewall logs and Shadowserver threat reports all landed in the same inbox with no way to separate the noise from the stuff that actually mattered. We built a system that does that automatically. It ingests the logs, classifies events by severity, detects anomalies against historical baselines, and surfaces everything in a single Flask dashboard instead of across three different tools. It won First Place at the UNH Undergraduate Research Conference, which was a cool way to close out four years.
-The hardest part was honestly just the scale. We're talking 20 million lines of log data generated every single day. You can't just load that into memory and hope for the best. Early on in the development, most of our problems were our programs crashing due to the sheer size of the files we were trying to load in. We spent a lot of time building the pipeline to stream and chunk the data efficiently, with multiprocessing to keep it fast enough to actually be useful in a real operational window. On the threat intelligence side, Shadowserver reports don't have a fixed structure, so parsing them reliably under full automation took more iteration than expected. A lot of the solutions came down to making the system configurable: filtering rules, sensitivity levels, alert recipients. This was all controlled through JSON config files so the IT team could tune behavior without ever touching the code.
-From a skills standpoint this project had everything: Python, Flask, SQLite, full-stack web dev, anomaly detection, automated alerting, and leading two parallel teams through Agile sprints on GitLab from start to finish. But honestly the thing I'm most proud of is that it actually works in production for a real client and hit the goal we promised. A 10:1 reduction in alert volume. Going from concept to something a real IT team relies on daily is the kind of experience you can't really replicate in a classroom.