My work sits at the intersection of offensive security, applied machine learning, and evidence-driven security engineering. I prioritize reproducible experiments, explicit threat models, and deployable controls over demos that cannot be independently inspected.

Project	Focus	Evidence
VoiceGuard	Voice deepfake detection, vishing defence, watermarking, and forensic explainability — XLS-R + AASIST at 2.84% EER (ASVspoof 2021 LA), 0.62 MB ONNX edge model	· README · tests · security policy
TrustWeave	Static security review of AI-agent configurations (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input that can reach privileged actions	· PyPI · docs · CITATION.cff
xai-ids	Multi-dataset intrusion detection with SHAP, LIME, XCS, and XGBoost, plus an XAI Confidence Score for analyst triage	· model card · results · live demo
MIRAGE SOC Lab	Controlled SOC lab for deterministic detection engineering: replayable telemetry, ATT&CK-mapped analyst cases, regression tests for the rule catalogue	detection guide · e2e tests · overview
DiskTrace	Read-only forensic recovery for disk images with explicit evidence boundaries and machine-readable export receipts (Rust)	· security policy
TokenAbuse-Azure	Device-code authentication abuse, Microsoft Graph enumeration, and SharePoint permission failures, with the KQL hunts and Conditional Access policy that catch the chain	write-up

For research discussions, security reviews, and collaboration, contact me through LinkedIn or email. The portfolio site contains the broader project index.

Security Intern, Security Department — Madar Alholool Project Management L.L.C (Orbit Solutions) · Dubai, UAE · Jun 2025 – Aug 2026 (part-time)

• Designed and set up the internal security infrastructure: logging pipelines, monitoring components and scripted security checks, then tuned the monitoring rules against real operational data to cut false positives.
• Ran vulnerability assessments and security reviews of internal applications, supported incident-response procedures, and integrated security checks into the development lifecycle with the engineering team.
• Built and hardened the public web, mail and DNS stack for madaralholool.com on Alibaba Cloud and AWS EC2: SPF, DKIM and DMARC on the corporate mail flow, TLS on every public endpoint, key-only SSH, least-privilege firewall rules, patching and access reviews.

SmartInject: Automated SQL Injection Testing Using Deep Q-Learning and LSTM-Based Payload Generation
_{M. Thabet (lead author), G. B. Satrya, A. Kermani — ICAMAC 2025, Dubai, UAE, pp. 1–6 · DOI: 10.1109/ICAMAC67779.2025.11398683
Hybrid DQN+LSTM agent achieving an 80% vulnerability-discovery rate at DVWA "High" vs. 0% for static-fuzzing and DQN-only baselines.}

Lightweight Voice Deepfake Detection for Smart Mobility Using Multi-Feature Ensemble Learning
_{M. Thabet Hassan (lead author), F. Sadek, A. Sami, A. Kermani Kolankeh — IEEE SM 2026, Al Alamein, Egypt, pp. 1–2 · DOI: 10.1109/SM69703.2026.11614145
Edge-deployable ensemble: F1 = 0.95, <2 MB model, 36.8 ms feature extraction. Extended into the open-source VoiceGuard platform: XLS-R + AASIST at 2.84% EER on the official ASVspoof 2021 LA benchmark, with explainability, signed C2PA provenance, and a 0.62 MB ONNX edge build.}

OTA Update-Channel Compromise Risk in Smart Mobility: A Testbed Comparing Governance and Cryptographic Controls
_{M. Thabet Hassan (lead author), O. Alraas, L. A. AbuSerrieh — IEEE SM 2026, Al Alamein, Egypt, pp. 1–2 · DOI: 10.1109/SM69703.2026.11614128
Monte-Carlo testbed (500 runs × 50,000 ECUs); layered governance cut median attack blast radius from 27,784 → 46 ECUs (99.7%).}

XAI-IDS: A Multi-Dataset Explainable AI Framework for Network Intrusion Detection with a Novel XAI Confidence Score
_{M. Thabet Hassan (lead author), F. Sadek, A. Sami, M. Khurana · Code
Ensemble IDS across CIC-IDS-2017, UNSW-NB15 & CSE-CIC-IDS-2018 (16M+ records); F1 up to 0.9964; novel XAI Confidence Score separating correct from incorrect predictions (Cohen's d = 1.0–1.2).}

• 🥇 1st place — Exploit3rs CTF (Zayed Sector & CyberE71), 2025 — national Capture-the-Flag; finished first across web, network, and binary-exploitation tracks
• 🥇 1st place & "Best Implementation Champion" — Dubai AI System Competition, 2024 (Alibaba Cloud / RTA Hackathon) — honoured at GITEX Global
• 🥇 1st place — CUD First Coding Competition (2023) · 🥈 2nd place — CUD Engineering Software Category (2024)
• 🎯 9th place — Sharjah Police CTF (2025)
• 📡 Workshops attended: Router Hacking · Network Pentesting 101 (Exploit3rs, hands-on exploitation & defence labs)

Offensive Security	Penetration Testing (OWASP Top 10) · Web / Network / Wireless Pentesting · Exploit Development · Privilege Escalation · MITM & Evil-Twin · Cloud & Identity Attacks (Entra ID / OAuth / Microsoft Graph) · OSINT · Responsible Disclosure
Blue Team / SOC	SIEM & Log Analysis · Incident Response · Threat Hunting · Threat Intelligence · Vulnerability Management · Detection Engineering & Threshold Calibration · Digital Forensics · Secure Coding
AI/ML Security	Adversarial ML & Robustness (FGSM / evasion) · Explainable AI (SHAP, LIME, Integrated Gradients) · Self-Supervised Audio Models (XLS-R / wav2vec2 / AASIST) · Deep RL (PPO, DQN) · LSTM Payload Generation · ONNX Edge Deployment · LLM-Agent Security (MCP, tool-use policy)
Frameworks	OWASP Top 10 · OWASP LLM Top 10 · MITRE ATT&CK · MITRE ATLAS · NIST SP 800-86 (Forensics) · C2PA Provenance
Tools	Hydra · John the Ripper · Aircrack-ng · hostapd · TokenTacticsV2
ML / Data	Stable-Baselines3 · LightGBM · captum
Programming
Cloud & Infra	DNS / SPF / DKIM / DMARC · CI/CD

Repository	What it is	Stars	Status
VoiceGuard	Voice-deepfake detection & vishing defence platform
trustweave	Static security review for AI-agent configs
xai-ids	Explainable multi-dataset intrusion detection
mirage-soc-lab	Deterministic detection-engineering SOC lab
disktrace	Read-only forensic recovery for disk images (Rust)
TokenAbuse-Azure	Entra ID device-code attack chain write-up + detections

📫 Open to red-team, SOC, and AI-security engineering opportunities.

LinkedIn · Email · Portfolio