By engineering high-throughput graph processing data loaders and deploying fine-tuned homogeneous transformer architectures, I eliminate analyst fatigue to optimize deep learning workflows for active security pipelines.
Core Artifact: Relational Graph Transformer Pipeline
Security Operations Centers (SOCs) process hundreds of alerts daily, yet most alerts received are benign, inevitably leading to analyst fatigue and missed threats. To automate triage, I engineered an end-to-end machine learning pipeline that models alerts, IP addresses, processes, and domains as a unified graph. This software framework targets SOAR alerts directly, combining IP behavioral statistics and rule identity encodings into shared feature projections. The pipeline trains with per-alert supervision and aggregates per-window predictions through a global max-pool layer, transforming unstructured security alerts into real-time, actionable inference.
The Data Engineering Hurdle: Synthetic Pipeline and Event Labeling
The single largest bottleneck in developing this system was that structured, labeled data for SOAR alerts simply does not exist in the open-source domain. To solve this data starvation problem, I had to architect an entire secondary backend pipeline from scratch dedicated strictly to parsing raw security logs, resolving cross-entity dependencies, and programmatically labeling operational events. Without a clean baseline dataset, the core challenge was mapping noisy network events into definitive threat timelines. Engineering this labeling pipeline and structuring custom data loaders to feed the resulting relational topologies into the model was the true foundation of this project’s operational success.
The Diagnostic Case: Overcoming Architectural Over-Engineering and Signal Dilution
When designing a deep learning model for relational topologies, the most complex academic approach is rarely the most operationally efficient. I initially built a heterogeneous graph transformer under the assumption that isolating distinct node types (alerts, IP addresses, processes, and domains) into separate mathematical message-passing layers was necessary.
Instead, this configuration introduced severe architectural bloat and feature representation waste. The complex heterogeneous boundaries made it difficult for the model to effectively map coordinated, multi-step attacks across different entities. To resolve this, I consolidated the pipeline into a unified, homogeneous graph topology (HomoGT) using shared feature projections. Forcing different entities into a single mathematical space instantly stripped away processing latency and allowed the transformer to trace attack paths without edge-type friction.
The Pooling Bottleneck
The second critical bottleneck emerged during graph aggregation. Early pipeline iterations relied on traditional average-pooling layers to summarize the temporal alert windows. However, because standard Security Operations Centers (SOCs) are flooded with benign background noise, average-pooling mathematically diluted the malicious signals. If a window contained ninety-nine safe alerts and one critical multi-step exploit, the average-pooling layer washed out the threat activation entirely, leading to catastrophic false negatives.
Enforcing Peak Activation via Max-Pooling
To fix this signal dilution, I re-engineered the aggregation layer to use global max-pooling. Rather than smoothing the values across the window, max-pooling isolates and extracts the absolute highest anomaly activation across the structural graph. This means that no matter how much benign noise a corporate network generates, a high-risk coordinated attack signature preserves its peak intensity all the way to final inference.
Operationalizing Efficiency
This architectural pivot allows the final framework to achieve an AUROC of 0.977 and an AUPRC of 0.897, completely outperforming graph models from other modalities like MAGIC and E-GraphSAGE, as well as log anomaly-focused models like LogBERT and heavy zero-shot prompted Large Language Models like Gemini and LLaMA. The model processes a single alert window in real time on consumer hardware. Operationalizing this system proves a core competency essential for ML infrastructure and research engineering: the ability to build scalable data loaders for relational topologies, execute comprehensive model ablations, and deliver production-ready deep learning tools optimized for practical deployment.
Generative AI Workflow Integration
To maintain absolute mathematical integrity for academic publication, the core machine learning architecture of HomoGT was engineered entirely by hand without AI-generated code. Instead, generative AI tools (such as Gemini and Claude) were integrated into my workflow to accelerate the manual overhead of research and technical writing.
I used generative AI models to handle three specific areas:
- Paper Formatting: I used generative tools as a precise formatting assistant, ensuring that the structure, citations, and layout of my research draft aligned exactly with formal academic publication requirements.
- Learning Core Concepts: When diving into the mechanics of Graph Neural Networks (GNNs), heterogeneous versus homogeneous setups, and graph aggregation methods, I used AI as an interactive learning partner. It helped me rapidly break down how data passes through relational topologies and grasp why max-pooling preserves peak activation signals better than standard average-pooling.
- Data Visualization and Graph Generation: To present my benchmark results, I used AI to generate custom plotting scripts. This automated the process of turning raw test metrics into clean, accurate charts and data visuals for the final presentation.