Abineshkumar Muthusamy

Research Assistant — Purdue University

West Lafayette, IN · Sep 2024 - May 2026

• Integrated secure audio messaging into the Signal Android app using Kotlin and Java, improving communication confidentiality by 80% through layered encryption and steganography.
• Built a standalone scalable secure messaging platform using Python (backend) and ReactJS (frontend), deployed on AWS EC2.
• Applied voice steganography, hiding sensitive messages within LLM-generated decoy audio to evade detection.
• Developed a high-fidelity Reduced Order Model (ROM) for power grids using Python and ML techniques for real-time anomaly detection.
• Working on building an AI-assisted clinical decision-support tool that gives physicians a synthesized view of a patient's longitudinal and family history, surfacing likely etiologies and contributing risk factors at the point of care.
• Engineering an LLM + Retrieval-Augmented Generation (RAG) pipeline in Python to extract structured risk factors and screening criteria from clinical guideline PDFs (AHA, USPSTF, NCCN, etc.) into a rules database which can be queried that powers automated risk scoring against patient records.

Teaching Assistant — Purdue University

West Lafayette, IN · Dec 2025 - May 2026

• Facilitated learning in CNIT-15501 (Software Development for Beginners), focusing on Python programming concepts and the Software Development Life Cycle (SDLC) to give students a practical foundation in building and shipping software.
• Developed instructional materials and hands-on resources coding exercises, walkthroughs, and reference guides to deepen student understanding and engagement across all SDLC phases.
• Collaborated with faculty to refine course delivery, align assessments with learning outcomes, and improve overall student performance.

System Engineer — Capgemini INDIA

INDIA · Apr 2023 - May 2024

• Provided L1/L2 production support for enterprise infrastructure and end-user services in a fast-paced ops environment; managing incidents, service requests, and escalations under SLA, leading triage, and delivering stakeholder status updates.
• Performed server reliability checks (CPU / memory / disk, services, logs) and alert/log triage using Splunk, building metrics dashboards and reducing repeat incidents through coordinated root-cause analysis with SMEs.
• Supported security/access operations (Active Directory provisioning, McAfee/Symantec endpoint troubleshooting) and AWS cloud operations (EC2 health checks, IAM access, S3 troubleshooting, backup/patch validation); participated in on-call rotations and maintained runbooks.

SecPolicy GPT - Compliance Framework Assistant

Tech: FastAPI, Python, RAG, ChromaDB, Claude API, Server-Sent Events, Vanilla JS, Docker

https://github.com/ABINESHKUMARMUTHUSAMY/secpolicy-gpt

• Built a RAG-powered compliance assistant that answers natural language questions across NIST 800-53, ISO 27001, SOC 2, PCI-DSS, NIST CSF, and CIS Controls, grounding every answer in cited control IDs.
• Engineered a cross-framework mapping engine with 179 curated control equivalences plus semantic fallback via vector similarity, solving the "we're SOC 2 certified - what ISO 27001 controls do we already cover?" problem.
• Designed a PDF ingestion pipeline that auto-detects the compliance framework, chunks documents at control boundaries (preserving IDs like AC-2 and A.9.2), and indexes them into a persistent ChromaDB vector store.
• Implemented streaming responses via Server-Sent Events with Claude's API, including prompt caching to reduce latency on repeated compliance queries.
• Built the full stack with a FastAPI backend and vanilla JS frontend featuring a dark cybersecurity-themed UI, drag-and-drop PDF upload, and a real-time sources citation drawer.

Network Threat Intelligence & Automated Response Platform

Tech: Python, FastAPI, React, XGBoost, Suricata, TimescaleDB, Redis, Docker, AWS, Scapy

https://github.com/ABINESHKUMARMUTHUSAMY/threat-intel-platform

• Built an end-to-end network detection system on AWS designed to hold up under adversarial pressure: Scapy feeds a flow aggregator into dual detectors running in parallel - an XGBoost behavioral classifier (trained on CICIDS2017) and Suricata with custom signatures for known attack patterns.
• Engineered an event-driven response engine consuming Redis stream alerts, with playbooks that block attacker IPs via iptables (TTL-based expiry) and isolate hosts by swapping AWS Security Groups; containment time dropped from ~6 minutes manual to ~12 ms automated (99.97% reduction) across 49,000+ runs.
• Validated defense-in-depth through adversarial testing: the ML model survived five wfuzz evasion attempts, while Suricata caught misses during early testing; added a React dashboard with a force-directed topology graph that visualizes attack flows in real time.

CloudTrap - AI-Driven Cloud Honeypot Network (AWS Serverless)

Tech: Python, AWS Lambda, Kinesis, DynamoDB, Terraform, React, TypeScript, CloudFront, Cognito, Anthropic Claude Haiku 4.5

https://github.com/ABINESHKUMARMUTHUSAMY/Cloudtrap

• Engineered a serverless AWS honeypot platform (Python Lambda, Kinesis, DynamoDB, Terraform; React / TypeScript dashboard on CloudFront with Cognito auth) that captured 1,204 attacker events from 69 unique source IPs across 15 countries during a one-week public deployment.
• Integrated Anthropic Claude Haiku 4.5 to produce session-level threat-actor classifications at ~$0.0005 per session, with real-time enrichment Lambdas mapping commands to MITRE ATT&CK techniques and end-to-end event-to-dashboard latency under 5 seconds.

Agentic AI for Malware Analysis

Tech: LangChain, Llama 3.2, Docker, Python, Forensics

https://github.com/drakejerez/581-project

• Engineered an autonomous AI agent to orchestrate malware investigations, reducing manual workload by 85%.
• Integrated Volatility 3 and YARA into a Dockerized pipeline for automated memory artifact extraction.
• Architected a secure SSH-based VM control environment ensuring 100% isolation for risky samples.

EcoAdapt: AI IoT Climate Control

Tech: IoT, Reinforcement Learning, ESP32, MQTT, Python

• Designed a smart energy solution using Reinforcement Learning to adapt HVAC/lighting in real-time.
• Built a distributed sensor network (ESP32, Camera, Motion) communicating via Mosquitto MQTT to Raspberry Pi.
• Implemented dual-mode functionality for autonomous AI regulation or manual control via ThingsBoard.

Capture The Flags, SRM University

Tech: Docker, DigitalOcean, Python, CTF Design, Cybersecurity Training

• Led and managed university CTF events for over 2 years during the SRM tech-fest while serving as Vice-President of the SRM Cyber Club.
• Hosted and maintained CTF infrastructure using Docker and DigitalOcean for reliable challenge deployment.
• Scripted Python automation to reboot servers during downtime and improve event availability.
• Designed and developed approximately 50 questions spanning penetration testing, Bash scripting, web exploitation, and related cybersecurity techniques.
• Inspired 700+ students to learn and sharpen practical cybersecurity skills through hands-on CTF participation.

Virtualized ICS Security Lab

Tech: OpenPLC, Conpot, Modbus TCP, InfluxDB, Grafana, Ignition SCADA, OPC-UA, Isolation Forest, Docker Networking

• Built a self-contained OT/ICS security research environment fully in software to demonstrate both offensive tradecraft and defensive controls without requiring physical PLC hardware.
• Engineered process logic in OpenPLC for a water-treatment workflow (tank level control, flow behavior, pump/valve interlocks, and high-high trip conditions) to emulate realistic industrial behavior.
• Deployed Conpot as a segmented decoy Modbus TCP endpoint to capture adversary interactions safely, separating attacker activity from the real control path and preserving process integrity.
• Implemented telemetry and observability with InfluxDB (5-second snapshots) and Grafana to visualize process variables, control signals, and anomaly scores in real time.
• Integrated Ignition SCADA Designer (Perspective HMI) over OPC-UA to replicate operator workflows and validate that attack effects were visible in a realistic SCADA interface.
• Simulated threat behavior with `modbus_enum.py`: FC3 register recon, FC1 coil enumeration, FC16 setpoint manipulation (SP-101 from 50% to 90%), and FC5 forced interlock/pump shutdown to model denial-of-service conditions.
• Added Isolation Forest anomaly detection on live telemetry and correlated Conpot timestamps with process anomalies, demonstrating deception-as-detection value for early warning and incident triage.

Database Forensics and Databases in Forensics

Tech: Database Forensics, Oracle SQL, MSSQL, MongoDB, SQLite, Log Analysis, Incident Investigation

• Conducted an end-to-end database forensics study focused on evidence reconstruction, timestamp validation, and post-incident activity tracing across relational and NoSQL systems.
• Compared forensic capabilities across Oracle SQL, MSSQL, MongoDB, and SQLite, including audit/event profiling behavior, trace/log artifacts, and reliability of action attribution.
• Analyzed practical recovery and validation workflows for deleted or tampered data, and evaluated defensive controls such as hashing, replication, sharding, and encryption to preserve evidence integrity.
• Researched emerging directions in the field - including NoSQL evidence extraction, anti-forensics analysis, and blockchain-assisted evidence traceability - and mapped their applicability to enterprise incident response.

Forensic Analysis of Phishing Emails (CIT 56200)

Tech: Email Forensics, Google Admin Toolbox, VirusTotal, SPF/DKIM/DMARC, Metadata Analysis, Chain of Custody, Threat Intelligence

• Led a CIT 56200 Mobile & Network Forensics final investigation analyzing phishing .eml evidence to uncover spoofed sender domains, malicious shortened URLs, and trust-building decoy attachments.
• Performed header and metadata forensics with Google Admin Toolbox, identifying that the message passed SPF, DKIM, and DMARC while still carrying a spoofed DKIM domain (d=argoogle.com) and inconsistent routing indicators.
• Correlated VirusTotal threat intelligence on embedded links and attachments: the shortened URL was flagged as phishing by Criminal IP, while a ~25-byte "security-threat-report.pdf" scanned clean across 61 vendors and appeared to function as a social-engineering decoy.
• Documented a full forensic workflow with timestamps, screenshots, and chain-of-custody practices, and completed supporting lab investigations of Outlook, Thunderbird, Slack, and Discord artifacts for email/chat evidence recovery.

M.S in Cybersecurity and Trusted Systems

Purdue University · Indianapolis, IN · May 2026 · GPA 3.93/4.0

Coursework: Wireless Security, Mobile & Network Forensics, Database Security, InfoSec Risk Assessment, Malware Forensics, IoT, Cloud Security and Privacy, Introduction to Cloud Infrastructure, Measurement and Evaluation in Industry and Technology, Network Security.

B.Tech in Computer Engineering

SRM University · Chennai, INDIA · May 2023 · GPA 3.75/4.0

Security Engineering

Threat Detection Engineering, Network Security, Threat Intelligence, Incident Response Automation, MITRE ATT&CK Mapping, Email & Chat Forensics, Phishing Analysis, Security Operations (L1/L2), Penetration Testing, YARA, Splunk

AI / ML & RAG

RAG Pipelines, LLM Application Development, Prompt Caching, Vector Search (ChromaDB), XGBoost, Anomaly Detection, LangChain, Claude API, Llama 3.2

Backend & Systems

Python, FastAPI, Java, Kotlin, C/C++, REST APIs, Server-Sent Events (SSE), Redis Streams, TimescaleDB, Docker, Linux, Bash Scripting

Cloud, Infra & Frontend

AWS (EC2, Lambda, Kinesis, DynamoDB, S3, CloudFront, Cognito, IAM, Security Groups), Terraform, React, TypeScript, Vanilla JS/HTML/CSS, Android Security (Kotlin/Java), IoT (ESP32/Raspberry Pi), MQTT, Git/GitHub Actions