Muhammad Abdullah Aamir

Developed a six-format malware detector (Win32, Win64, .NET, ELF, PDF, APK) using calibrated ensembles of XGBoost, LightGBM, and Random Forest, trained across three datasets from three different papers (EMBER2018, BODMAS, EMBER2024).

Developed

Python tooling to validate the model on 3,200+ real malware samples from MalwareBazaar and 2,000+ benign files from clean GitHub repositories and system binaries, tracing the 30-point gap between benchmark (96%) and real-world accuracy to a code-signing confound in the training data. Integrated the detector into Wazuh (open-source SIEM) with a 5,029-rule YARA Forge Core package for malware-family attribution, cutting time-to-verdict on a monitored endpoint to 277 ms against a 36-second VirusTotal reputation-lookup baseline.

Intern - NESCOM CENTech - Islamabad, Pakistan

(2026-06 - 2026-08)

• Developed a six-format malware detector (Win32, Win64, .NET, ELF, PDF, APK) using calibrated ensembles of XGBoost, LightGBM, and Random Forest, trained across three datasets from three different papers (EMBER2018, BODMAS, EMBER2024).
• Developed Python tooling to validate the model on 3,200+ real malware samples from MalwareBazaar and 2,000+ benign files from clean GitHub repositories and system binaries, tracing the 30-point gap between benchmark (96%) and real-world accuracy to a code-signing confound in the training data.
• Integrated the detector into Wazuh (open-source SIEM) with a 5,029-rule YARA Forge Core package for malware-family attribution, cutting time-to-verdict on a monitored endpoint to 277 ms against a 36-second VirusTotal reputation-lookup baseline.
• Configured an OPNsense firewall (GeoIP and domain filtering) and an automated n8n workflow that logs Wazuh alerts and sends alert as a detailed message to an analyst's Discord channel.

Bachelor of Science - Computer Science - National University of Computer & Emerging Sciences FAST (2022-08 - 2026-06)