Resume (PDF)
Menu

Open to detection & SOC internships

Truong Dinh

Hover over the name or focus it and press Enter to bounce the letters.

Security engineering · detection engineering · SOC

USF cybersecurity student · graduating May 2028

I build network defenses, replay real attacks, and leave a clear handoff for the SOC. My IPv6 research found a stateless rule with zero false positives across 1M real packets.

Explore the work Email me
DETECTION ENGINE / REPLAYNETWATCH
TRAFFIC INANALYST HANDOFF
CAPTURE31Mpackets DETECT18detectors CORRELATE167incidents
31M REAL PACKETS6 HELD-OUT ATTACKS
A single packet moves through capture, detection and correlation into an analyst-ready incident queue.
Program
B.S. Cybersecurity · USF · May 2028
GPA
4.0 / 4.0
Certified
CompTIA Security+
CDSA status
Exam taken · result pending

Built, measured, investigated

Every figure below came from my own runs, on data I can name.

NetWatch SOC

Network detectionMay 2025 to Oct 2026

A network intrusion detection system in Python. Deep packet inspection over 21 protocols feeds 18 detectors mapped to 16 MITRE ATT&CK techniques across 9 tactics, each validated by purple-team attack emulation. Alerts are correlated into incidents and streamed to Splunk.

Validated on
31M real packets
Development false alerts / host-hour
375 → 1.1
Alerts to incidents
662 → 167
Throughput
5,873 packets/s
  • Python
  • Suricata
  • Flask
  • PostgreSQL
  • Docker
  • Splunk
Open the live demo (opens in a new tab) Code on GitHub (opens in a new tab)
A two-minute walkthrough of the dashboard, replaying real CSE-CIC-IDS2018 attack traffic. Try the live demo (opens in a new tab) It may take a moment to wake on its free host.
Read the case studyHide the case study

Validation

Tested on 31M packets of labelled real traffic from CSE-CIC-IDS2018, not just synthetic scenarios. The first version raised 375 false alerts per host-hour on the development days.

Root cause

I traced the noise to 5 detection-logic flaws and fixed them without tuning a single threshold. On the development set, false alerts fell to 1.1 per host-hour; the two held-out sets measured 1.3 and 0.4.

Against Suricata

Across 6 held-out attacks / 82 host-hours, NetWatch round 2 detected 6 of 6 at 1.0 false alerts per host-hour. Suricata 7.0.3 with ET Open (severity 1–2 only; rules dated Dec 11, 2024) detected 3 of 6 at 26.7. NetWatch caught the HTTP floods, Slowloris and brute force that the signatures missed. Method, configuration and per-capture results (opens in a new tab).

Triage

Alerts are correlated into incidents, turning 662 real-traffic alerts into 167 (75% fewer), and streamed to Splunk via HEC with a 5-panel dashboard and 5 scheduled correlation searches.

Wazuh Detection Engineering Lab

Detection engineeringAug 2026 to present

A segmented home SOC where I run Atomic Red Team on a Windows workstation and attack it over the network from Kali, check what Wazuh catches out of the box, and write rules for what it misses. Every rule ships with a test, a screenshot of the alert, and a note on what it still does not catch.

Attack simulations
15
Custom rules
23 + 1 decoder
Gaps closed
11 techniques
CI regression samples
47
  • Wazuh 4.14
  • Sysmon
  • Atomic Red Team
  • Active Directory
  • OPNsense
  • Suricata
  • GitHub Actions
Code on GitHub (opens in a new tab) Evidence log (opens in a new tab)
Wazuh lab network An OPNsense firewall routes four isolated segments. Atomic Red Team runs on the Windows 11 workstation itself, while Kali in the attack segment sends network attacks to it. The workstation and the domain controller send logs to Wazuh through agents, and the firewall sends syslog. Internet FW01 · OPNsenserouting · DNS · Suricata IDS ATTACK 10.10.50.0/24Kalinmap · smbclientnetwork tests only CLIENTS 10.10.30.0/24WS01Win 11 · Atomic Red TeamSysmon · 4688 · 4104 SERVERS 10.10.20.0/24DC01Windows Server 2025domain corp.lab SECURITY 10.10.40.0/24WAZUH 4.14manager · indexerdashboard · 23 rules agent syslog 514 T1046 · T1110 attack logs to Wazuh MGMT 10.10.10.0/24 · VMware Fusion host
Five isolated segments behind OPNsense. I run Atomic Red Team on WS01, scan and brute-force it from Kali, check what Wazuh's defaults catch, then write and test a rule for each miss. Lab setup (opens in a new tab)
Read what changed how I write rulesHide the lessons

Lab

Five segments behind an OPNsense firewall: a Windows Server 2025 domain controller, a domain-joined Windows 11 target with Sysmon, 4688 and 4104 logging by GPO, a Wazuh manager, and a Kali box for network-only attacks (nmap, SMB logons). Atomic Red Team runs on the workstation itself.

First match wins

Rules sharing a parent run in file order. My net.exe account rule shadowed the group rule until I reordered and tightened them.

Blocked means invisible

Defender stopped certutil at process creation and Sysmon logged nothing. Security event 4688 still saw the launcher, so each such rule has a 4688 twin.

Test the boundary

The mass account creation rule stays silent at 9 accounts in 60 seconds and fires at 10. CI checks the XML, the ATT&CK layer and 47 regression samples on every push.

Rule 100101: renamed systeminfo.exeT1082 · T1036.003
<rule id="100101" level="8">
  <if_group>sysmon_event1</if_group>
  <!-- trust the PE header, not the file name -->
  <field name="win.eventdata.originalFileName"
         type="pcre2">(?i)^(sysinfo|systeminfo)\.exe$</field>
  <field name="win.eventdata.image" type="pcre2"
         negate="yes">(?i)\\systeminfo\.exe$</field>
</rule>

Copies of systeminfo, schtasks and wevtutil under other names slipped past my first image-path rules. Matching the original file name from the PE header caught them.

Vorrin

Cloud security & DevSecOpsDec 2025 to present

A read-only AWS auditor with 14 checks across IAM, S3 and CloudTrail. It caught 25/25 labeled misconfigurations with zero unexpected findings across 98 fixtures.

Rules
14
CIS AWS controls
11
Offline fixtures
98
  • Python
  • Boto3
  • Terraform
  • Checkov
  • OPA/Rego
  • Syft/Grype
  • Cosign
  • GitHub Actions
  • AWS IAM, S3, CloudTrail
  • pytest
Code on GitHub (opens in a new tab)
Read the case studyHide the case study

Problem

Account misconfiguration is quiet. Wildcard policies, missing MFA, stale access keys and public buckets do not announce themselves.

Build

A read-only auditor with 14 checks across IAM, S3 and CloudTrail, plus Checkov and OPA/Rego scans for Terraform and Kubernetes. It caught 25/25 labeled misconfigurations with zero unexpected findings across 98 fixtures.

Architecture

A runtime guard rejects AWS API calls outside an explicit read-only allowlist. CI generates the least-privilege IAM policy from that allowlist and fails if the two drift apart.

Rigour

11 of 14 checks map to CIS AWS Foundations Benchmark v3.0.0. The suite has 1,456 tests and 86% branch coverage; Syft/Grype gate the SBOM and Cosign signs release artifacts.

The auditor's HTML report for a deliberately misconfigured lab account: 25 findings across 17 resources, split into 4 critical, 5 high, 11 medium, 3 low and 2 informational.
The self-contained HTML report from a scan of a deliberately misconfigured lab account. See the repo

BOTSv3 investigation

Incident responseAug to Sep 2026

A multi-stage intrusion in Splunk's public Boss of the SOC v3 dataset threat-hunted with SPL across 5 log sources spanning Windows endpoints and AWS.

IOCs extracted
8
ATT&CK techniques
13
Log sources
5
  • Splunk
  • SPL
  • Sysmon
  • Windows Event Logs
  • AWS CloudTrail
Read the report (opens in a new tab)
Read the case studyHide the case study

Problem

An intrusion leaves traces across endpoints, Windows logs and the cloud control plane. No single source tells the whole story.

Hunt

SPL pivots across 5 log sources, including Sysmon, Windows Event Logs and AWS CloudTrail, to rebuild the attack timeline end to end.

Findings

A browser-delivered PowerShell Empire launcher, a fodhelper UAC bypass, a backdoor local admin and HTTPS beaconing that spread to a second host. 8 IOCs and 13 ATT&CK techniques.

Hand-off

An incident report mapped to 13 ATT&CK techniques, with containment steps, per-stage SPL rules and false-positive analysis.

Detection 5: PowerShell C2 beaconingT1071.001
index=botsv3 sourcetype=XmlWinEventLog source=*Sysmon* EventCode=3
  Image="*\\powershell.exe"
| stats count by host DestinationIp DestinationPort
| where count > 100

Run against the full dataset, only two hosts crossed the threshold: FYODOR-L (3,849 connections) and ABUNGST-L (1,070), both to the confirmed C2 server.

Detection 3: fodhelper UAC bypassT1548.002 · 2 hits, 1 host
index=botsv3 sourcetype=XmlWinEventLog source=*Sysmon* EventCode=1
  Image="*\\fodhelper.exe" ParentImage="*\\powershell.exe"
| table _time host User ParentCommandLine
More field notes, tools, and source code tdinh-dev-sec-scientist

Before packets, it was proofs

I started with competition mathematics: valedictorian of the natural-sciences track and a provincial award. Reading an IPv6 extension-header chain uses the same instinct as taking apart a geometry proof: name the pieces, test the assumptions, then explain the result.

  • Decompose

    If I can't draw it as labelled fields, I don't understand it yet.

  • Reproduce

    A finding isn't real until it happens twice in an environment I control, and until I've tried to break my own result.

  • Hand it over

    The write-up is the deliverable. Analysis nobody else can act on is a hobby.

Undergraduate research · IPv6 covert channel detection

The Invisible Tunnel

I built a command-and-control channel that hides inside IPv6 packets while staying compliant with RFC 8200, then tried to catch it. A one-line rule beat the hard part. The adaptive attacker taught me to distrust a single AUC.

Where
Austin Peay State University
Advisor
Dr. James Church, CS & IT
Period
Dec 2025 to Aug 2026
Recognition
2nd Place, STEM Division, APSU Student Research Symposium 2026
Selected for
Tennessee Student Posters at the Capitol 2026

One stateless RFC 8200 rule

Flag any IPv6 PadN option whose padding bytes are not zero. The RFC says they should be, and receivers ignore them, so non-zero padding is the covert signal.

# D3: exact stateless check, replayed over PCAPs
if opt.type == PadN and any(opt.data): alert()

0false positives in 1,000,000 real MAWI IPv6 packets

On the naive channel it matches a supervised Random Forest at AUC-ROC 1.0. No training, no state.

Read the full studyHide the full studyHow the channel works, the header fields, adaptive mimicry and what the detectors showed

How the channel works

  1. IPv6 packet

    A normal-looking datagram leaves the sender.

  2. Destination Options

    An extension header most parsers skim rather than read.

  3. PadN carries bits

    Padding bytes that should be zero carry data instead.

  4. PRNG Flow Label

    Authenticates the session in a field that usually looks like noise.

  5. Shift and masquerade

    A Next-Header shift and TLS masquerade slipped past port-443 BPF, Snort Next-Header rules and DPI.

  6. One stateless rule

    Non-zero PadN. 0 false positives in 1M real MAWI packets.

IPv6 fixed header, RFC 8200

Pick a field

8 bits, byte 6

Names whatever comes next: TCP, UDP or another extension header. Chain enough of them and a parser has to walk the whole list. This is the field my research reads closest.

Adaptive mimicry, de-confounded

As the attacker mimics benign traffic
Aggregate AUC
0.92 → 0.49
Per-covert-packet AUC
0.92 → 0.92
Covert capacity
20 → 0 bits/slot

The headline number collapsed, but each covert packet stayed just as detectable. Evasion was paid for in bandwidth: by the time the channel looked benign, it carried nothing.

Attack

A red-team proof of concept: an IPv6 C2 channel in Destination Options PadN with PRNG Flow Label authentication, built and tested in a controlled testbed. Motivated by CVE-2024-38063.

Experiment

Five unsupervised and supervised detectors (Autoencoder, One-Class SVM, LOF, Random Forest, RBF-SVM) on a leak-free disjoint split over a 1M-packet MAWI benign corpus.

Debugging the result

One-Class SVM scored below chance. A scaler and hyperparameter sweep traced it to a preprocessing artifact, not a property of the channel, before I trusted any comparison.

Finding

Against the naive channel, machine learning adds nothing over the one-line rule. Against an adaptive attacker, per-packet AUC holds near 0.92; the aggregate drop measures lost capacity, not evasion.

Read the preprint (opens in a new tab) Code on GitHub (opens in a new tab)
  • Python
  • Scapy
  • scikit-learn
  • TensorFlow
  • Suricata
  • Snort

Skills, traced to evidence

The toolchain, wired to the work

Select a tool or project. The network reveals where it appears in my work.

45 tools · 5 projects · 53 links. Select any item to trace the evidence.

SIEM, detection and response

Cloud security and automation

Networks and systems

Languages and data

projects on this page that use the tool coursework and practice so far

Pudding Drive: build sequence

Research → detection engineering → SOC. The next step is shipping that work with a real team.

A signal prism refracting violet light A hand-drawn, faceted prism floats in a field of refracted light, representing signals becoming evidence.
FIELD NOTE / 01Signals become evidence.
  2. build 1Honor2024

    Alpha Lambda Delta Honor Society

    Austin Peay State University, Clarksville, TN

    Inducted, and on the Dean's List every semester at APSU.

  3. build 2LeadershipJul to Dec 20256 mo

    Peer Leader, Honors Program

    Austin Peay State University

    Led 15 course sessions for a 30-student Honors cohort as student-faculty liaison, and published 16 weekly cybersecurity-awareness posts.

  4. build 3CertificateAug 2025

    Google Cybersecurity Professional Certificate

    Completed

  5. build 4ResearchDec 2025 to Aug 20269 mo

    Undergraduate Security Researcher

    Austin Peay State University, advised by Dr. James Church

    IPv6 covert channel detection, published as a preprint on Zenodo. Won 2nd Place, STEM Division at the APSU Student Research Symposium and was selected for Tennessee Student Posters at the Capitol.

  6. build 5TeachingJan to May 20265 mo

    Computer Science Teaching Assistant

    Austin Peay State University, CS & IT Department

    Diagnosed 200+ Java defects (recursion, object references, data structures) for 30+ students in 2 hours a week of office hours, as the class average rose from 60% to 75%.

  7. build 6EducationNow, graduating May 2028

    B.S. Cybersecurity

    University of South Florida, Tampa, FL

    Coursework in Network Security, Operating Systems, Computer Networks, Cryptography, Penetration Testing, and Data Structures & Algorithms. Inaugural cohort mentee in USF's Bellini Mentorship Program.

  8. build 7CertificationOct 2026

    CompTIA Security+ (SY0-701)

    Certified

  9. build 8TrainingOct 2026

    HTB SOC Analyst Job-Role Path

    Hack The Box Academy, completed

  10. build 9Competition2026

    Dragos CTF, ICS/OT

    Solo perfect score: 28,600/28,600, among 1,000+ teams

    48-hour forensics using Modbus and BACnet PCAPs.

  11. build 10AssessmentNov 2026

    HTB Certified Defensive Security Analyst

    Intermediate level, 7-day practical exam and report taken. Result pending.

  12. build 11Next

    security.internship  * * *

    No reply yet. If your team does detection engineering, security operations or cloud security, this hop could be yours.

Looking for a security internship

Detection engineering, security operations, protocol research or cloud security. I want a team where findings get written down and acted on. Email is the fastest way to reach me, and I reply to everything.

Email ddinh1@usf.edu

Ask PuddingPORTFOLIO GUIDE