Cybersecurity researcher and B.Sc. Cyber Security graduate (Canadian University of Dubai, May 2026)
with three IEEE Xplore papers as lead author and a fourth in preparation for an Elsevier Q1 journal.
First-place national CTF champion with hands-on experience securing production cloud and email
infrastructure (AWS, Alibaba Cloud) and building research-grade offensive and AI-security tooling —
from deep-RL SQL-injection agents to edge-deployable deepfake detection.
🔴 Offensive — web / network / wireless pentesting · cloud & identity attacks · exploit development
🔵 Defensive — detection engineering · SIEM & log analysis · digital forensics · incident response
🔬 Research — AI/ML security · adversarial ML · explainable AI · audio anti-spoofing
🎯 Targeting — red-team, SOC, and AI-security engineering roles
🌐 Arabic (native) · English (B2, professional working proficiency)
My work sits at the intersection of offensive security, applied machine learning, and evidence-driven security engineering. I prioritize reproducible experiments, explicit threat models, and deployable controls over demos that cannot be independently inspected.
| Project | Focus | Evidence |
|---|---|---|
| VoiceGuard | Voice deepfake detection, vishing defence, watermarking, and forensic explainability — XLS-R + AASIST at 2.84% EER (ASVspoof 2021 LA), 0.62 MB ONNX edge model |  · README · tests · security policy |
| TrustWeave | Static security review of AI-agent configurations (LangGraph, CrewAI, OpenAI Agents, MCP): maps source-to-tool flows and flags untrusted input that can reach privileged actions |  · PyPI · docs · CITATION.cff |
| xai-ids | Multi-dataset intrusion detection with SHAP, LIME, XCS, and XGBoost, plus an XAI Confidence Score for analyst triage |  · model card · results · live demo |
| MIRAGE SOC Lab | Controlled SOC lab for deterministic detection engineering: replayable telemetry, ATT&CK-mapped analyst cases, regression tests for the rule catalogue | detection guide · e2e tests · overview |
| DiskTrace | Read-only forensic recovery for disk images with explicit evidence boundaries and machine-readable export receipts (Rust) |  · security policy |
| TokenAbuse-Azure | Device-code authentication abuse, Microsoft Graph enumeration, and SharePoint permission failures, with the KQL hunts and Conditional Access policy that catch the chain | write-up |
For research discussions, security reviews, and collaboration, contact me through LinkedIn or email. The portfolio site contains the broader project index.
Security Intern, Security Department — Madar Alholool Project Management L.L.C (Orbit Solutions) · Dubai, UAE · Jun 2025 – Aug 2026 (part-time)
- Designed and set up the internal security infrastructure: logging pipelines, monitoring components and scripted security checks, then tuned the monitoring rules against real operational data to cut false positives.
- Ran vulnerability assessments and security reviews of internal applications, supported incident-response procedures, and integrated security checks into the development lifecycle with the engineering team.
- Built and hardened the public web, mail and DNS stack for madaralholool.com on Alibaba Cloud and AWS EC2: SPF, DKIM and DMARC on the corporate mail flow, TLS on every public endpoint, key-only SSH, least-privilege firewall rules, patching and access reviews.
M. Thabet (lead author), G. B. Satrya, A. Kermani — ICAMAC 2025, Dubai, UAE, pp. 1–6 · DOI: 10.1109/ICAMAC67779.2025.11398683
Hybrid DQN+LSTM agent achieving an 80% vulnerability-discovery rate at DVWA "High" vs. 0% for static-fuzzing and DQN-only baselines.
M. Thabet Hassan (lead author), F. Sadek, A. Sami, A. Kermani Kolankeh — IEEE SM 2026, Al Alamein, Egypt, pp. 1–2 · DOI: 10.1109/SM69703.2026.11614145
Edge-deployable ensemble: F1 = 0.95, <2 MB model, 36.8 ms feature extraction. Extended into the open-source VoiceGuard platform: XLS-R + AASIST at 2.84% EER on the official ASVspoof 2021 LA benchmark, with explainability, signed C2PA provenance, and a 0.62 MB ONNX edge build.
M. Thabet Hassan (lead author), O. Alraas, L. A. AbuSerrieh — IEEE SM 2026, Al Alamein, Egypt, pp. 1–2 · DOI: 10.1109/SM69703.2026.11614128
Monte-Carlo testbed (500 runs × 50,000 ECUs); layered governance cut median attack blast radius from 27,784 → 46 ECUs (99.7%).
M. Thabet Hassan (lead author), F. Sadek, A. Sami, M. Khurana · Code
Ensemble IDS across CIC-IDS-2017, UNSW-NB15 & CSE-CIC-IDS-2018 (16M+ records); F1 up to 0.9964; novel XAI Confidence Score separating correct from incorrect predictions (Cohen's d = 1.0–1.2).
- 🥇 1st place — Exploit3rs CTF (Zayed Sector & CyberE71), 2025 — national Capture-the-Flag; finished first across web, network, and binary-exploitation tracks
- 🥇 1st place & "Best Implementation Champion" — Dubai AI System Competition, 2024 (Alibaba Cloud / RTA Hackathon) — honoured at GITEX Global
- 🥇 1st place — CUD First Coding Competition (2023) · 🥈 2nd place — CUD Engineering Software Category (2024)
- 🎯 9th place — Sharjah Police CTF (2025)
- 📡 Workshops attended: Router Hacking · Network Pentesting 101 (Exploit3rs, hands-on exploitation & defence labs)
| Offensive Security | Penetration Testing (OWASP Top 10) · Web / Network / Wireless Pentesting · Exploit Development · Privilege Escalation · MITM & Evil-Twin · Cloud & Identity Attacks (Entra ID / OAuth / Microsoft Graph) · OSINT · Responsible Disclosure |
| Blue Team / SOC | SIEM & Log Analysis · Incident Response · Threat Hunting · Threat Intelligence · Vulnerability Management · Detection Engineering & Threshold Calibration · Digital Forensics · Secure Coding |
| AI/ML Security | Adversarial ML & Robustness (FGSM / evasion) · Explainable AI (SHAP, LIME, Integrated Gradients) · Self-Supervised Audio Models (XLS-R / wav2vec2 / AASIST) · Deep RL (PPO, DQN) · LSTM Payload Generation · ONNX Edge Deployment · LLM-Agent Security (MCP, tool-use policy) |
| Frameworks | OWASP Top 10 · OWASP LLM Top 10 · MITRE ATT&CK · MITRE ATLAS · NIST SP 800-86 (Forensics) · C2PA Provenance |
| Tools |          Hydra · John the Ripper · Aircrack-ng · hostapd · TokenTacticsV2 |
| ML / Data |         Stable-Baselines3 · LightGBM · captum |
| Programming |          |
| Cloud & Infra |      DNS / SPF / DKIM / DMARC · CI/CD |
B.Sc. in Cyber Security — Canadian University of Dubai · Graduated May 2026 · CGPA 3.46 / 4.0
Relevant coursework: Network Security · Ethical Hacking · Cryptography · Secure Software Engineering · Digital Forensics · Machine Learning
Certifications by domain (click to expand)
| Domain | Certifications |
|---|---|
| Offensive Security | Ethical Hacker (Cisco Networking Academy, 2026) · Ethical Hacking Essentials (EC-Council, 2024) · Advanced Exploitation & Scripting Techniques (Packt, 2024) |
| Blue Team / Defensive | Google Cybersecurity Professional Certificate (2023) · Nomu Digital Bootcamp: Cybersecurity (Abdulla Al Ghurair Foundation & Sprints, 2025) · AWS Cloud Quest: Security (AWS Training & Certification) · OPSWAT Introduction to Critical Infrastructure Protection (ICIP) |
| AI / ML | Google AI Professional Certificate (2026) · Introduction to Modern AI (Cisco Networking Academy, 2026) · Build Real-World AI Apps with LangChain and RAG (Coursera, IBM & Scrimba) |
| Networking & Cloud | AWS Educate: Introduction to Cloud 101 · Introduction to Networks & Cisco Devices (Coursera Project Network, 2024) |
| CS & Data | Java & OOP (UPenn) · Data Structures (UC San Diego) · Introduction to Databases (Meta) · Responsive Website Basics (University of London) · GitHub Foundations · Data Analysis & Visualization with Power BI (Udacity Nanodegree) |
Full list with verification links on the portfolio site.
Click a badge to verify it on Credly.
| Repository | What it is | Stars | Status |
|---|---|---|---|
| VoiceGuard | Voice-deepfake detection & vishing defence platform |  |
 |
| trustweave | Static security review for AI-agent configs |  |
 |
| xai-ids | Explainable multi-dataset intrusion detection |  |
 |
| mirage-soc-lab | Deterministic detection-engineering SOC lab |  |
 |
| disktrace | Read-only forensic recovery for disk images (Rust) |  |
 |
| TokenAbuse-Azure | Entra ID device-code attack chain write-up + detections |  |
 |
