Damilola Ogunsuyi

WORK HISTORY

EDUCATION

ABOUT DAMILOLA OGUNSUYI

I build security data systems that learn and improve over time.At UMBC\'s R1 research lab, I deploy and evaluate ML models on network routers for traffic detection — balancing accuracy, privacy, and performance constraints on embedded hardware.In my homelab, I designed Argus: a multi-node security data platform built around a core research question: can ML-based detection systems be made resilient to adversarial manipulation?Argus spans three physical nodes: a laptop running Wazuh in Docker with Kali Linux and Windows VMs for attack simulation, a dedicated Ubuntu inference tower hosting FastAPI, a local LLM, a Parquet data lake, and a Surface Pro as the real-time analyst dashboard.Within Argus I am developing Themis: an autonomous SOC analyst with a three-tier decision architecture. Wazuh alerts are validated against a versioned data contract, transformed into feature vectors enriched with per-entity behavioral baseline deltas, and scored by a custom-trained XGBoost classifier. Below 0.4 suppressed, above 0.85 escalated, the middle band routed to Qwen 2.5 via Ollama for LLM triage reasoning augmented by ChromaDB semantic memory. Every decision is written to a time-partitioned Parquet lake with full lineage, monitored by a pipeline observability layer, and queryable via DuckDB. The classifier is trained in Jupyter and deployed to the inference tower via SCP, with human overrides feeding back as labeled training data.A dedicated on-demand hunting model running on the laptop translates natural language questions into DuckDB queries against the live data lake surfacing anomalies, behavioral patterns, and historical decision context in real time without writing SQL.Dolos is an adversarial model designed to induce model drift and simulate modern attacker strategies evading the classifier and executing slow normalization attacks that poison behavioral baselines over time. The research loop between Themis and Dolos is the core contribution.I also maintain a detection-as-code pipeline using GitHub Actions to version, test, and deploy Wazuh rules mapped to MITRE ATT & CK coverage.My work sits at the intersection of detection engineering, security data engineering, and applied ML. Always open to collaborating — feel free to reach out.