Nihar Mehta

• Web application firewall

  SecurityWeb Apps2026

  SafeLine WAF on a bare-metal hypervisor

  A web application firewall running as its own security VM on a KVM/QEMU hypervisor, inspecting every request before it reaches the web application.

  Personal project

  • KVM / QEMU
  • NGINX
  • ModSecurity v3
  • OWASP CRS
  • iptables
  • Ubuntu

  Code for SafeLine WAF on a bare-metal hypervisor on GitHub (opens in new tab)

  Read case study: SafeLine WAF on a bare-metal hypervisor

  Problem

  Web applications face SQL injection, XSS, command injection, path traversal and flood attacks, and need protection that sits in front of the app rather than inside it.

  Approach

  A dedicated WAF virtual machine on a Type-1 hypervisor with three protection layers: iptables and kernel hardening at the network layer, NGINX rate limiting at the application layer, and ModSecurity with the OWASP Core Rule Set inspecting payloads.

  Result

  Blocks SQL injection, XSS, remote code execution, local file inclusion, path traversal and DoS/DDoS traffic before it reaches the backend, with scripts for setup, testing and monitoring.

• Network security

  Security2026

  NetSentinel: IDS/IPS with machine learning

  A lightweight network intrusion detection and prevention system that combines signature rules with machine-learning anomaly detection.

  Personal project

  • Python
  • Scapy
  • scikit-learn
  • Isolation Forest
  • pandas
  • Matplotlib

  Code for NetSentinel: IDS/IPS with machine learning on GitHub (opens in new tab)

  Read case study: NetSentinel: IDS/IPS with machine learning

  Problem

  Signature rules catch known attacks but miss new ones, while small teams still need real-time visibility into their network traffic.

  Approach

  Real-time packet capture with Scapy, a rule engine for port scans, SYN and ICMP floods, suspicious ports and DNS amplification, plus Isolation Forest anomaly detection that learns normal traffic. Runs in detection (IDS) or prevention (IPS) mode.

  Result

  Real-time alerts with severity levels and a dashboard showing alert timelines, traffic heatmaps and top attacker IPs.

• Security automation

  SecuritySoftware2026

  Mini SOAR platform with n8n

  Automated threat detection and response: a security alert is enriched with threat intelligence, scored and, if dangerous, blocked automatically.

  Personal project

  • n8n
  • Docker
  • VirusTotal API
  • AbuseIPDB API
  • JavaScript
  • Webhooks

  Code for Mini SOAR platform with n8n on GitHub (opens in new tab)

  Read case study: Mini SOAR platform with n8n

  Problem

  Investigating each security alert by hand takes 10–15 minutes, which does not scale when alerts arrive by the hundred.

  Approach

  An n8n workflow receives alerts by webhook, queries VirusTotal and AbuseIPDB in parallel, merges the results, calculates a risk score and routes high-risk IPs to the firewall for blocking while logging the rest.

  Result

  Alerts are triaged and high-risk IPs blocked automatically in about four seconds per alert, with every step logged.

• Incident response

  SecuritySoftware2025

  SOAR playbooks with Shuffle

  Tailored incident-response playbooks that connect detection, threat intelligence and case management into one automated workflow.

  Freelance consulting work

  • Shuffle SOAR
  • Wazuh
  • MISP
  • TheHive

  Code for SOAR playbooks with Shuffle on GitHub (opens in new tab)

  Read case study: SOAR playbooks with Shuffle

  Problem

  Alerts from detection tools, threat intelligence and case management lived in separate tools, slowing down containment.

  Approach

  Designed SOAR playbooks in Shuffle that integrate Wazuh (detection), MISP (threat intelligence) and TheHive (case management).

  Result

  Faster, more consistent threat containment and remediation workflows.

• Access auditing

  Security2025

  Windows user & admin-group audit

  PowerShell tooling that snapshots local user accounts and privileged group membership and highlights every change.

  Personal project

  • PowerShell
  • Windows
  • JSON

  Code for Windows user & admin-group audit on GitHub (opens in new tab)

  Read case study: Windows user & admin-group audit

  Problem

  Unexpected new accounts or additions to the Administrators group are a classic sign of compromise, but are easy to miss.

  Approach

  Scripts that save JSON snapshots of local users and groups, compare two snapshots, and a test harness that creates and removes a dummy admin user to prove detection works.

  Result

  A clear before/after report of added or removed users and Administrators-group changes.

• IoT & MQTT

  Communication TechnologySecurity2025

  IoT traffic analysis: MQTT with Wireshark

  A case study capturing and analysing MQTT traffic between simulated IoT devices and a broker to expose unencrypted communication.

  Case study

  • Wireshark
  • MQTT
  • IoT
  • TLS

  Code for IoT traffic analysis: MQTT with Wireshark on GitHub (opens in new tab)

  Read case study: IoT traffic analysis: MQTT with Wireshark

  Problem

  Many IoT devices talk over unencrypted MQTT, exposing credentials and sensor data to interception, spoofing and replay attacks.

  Approach

  Set up an MQTT broker and simulated sensor, captured the publish/subscribe traffic in Wireshark and analysed payloads, headers and topics.

  Result

  Demonstrated plain-text message exposure and documented defences: MQTT over TLS, broker authentication, topic permission audits and traffic monitoring.

Certifications

• EC-Council Certified Security AnalystEC-Council
• Security Operation CenterIBM
• Cybersecurity ArchitectureIBM
• Ethical HackerCisco
• Junior Cybersecurity AnalystCisco
• CEH v13 (in progress)EC-Council