understand --from-the-wire
Understand what your network is actually doing.
I’m Salman Youssef. I combine deep protocol knowledge, hands-on packet analysis, and AI engineering to investigate network behaviour and build systems that learn from network data.
$ inspect connection.pcap
Three packets.
A connection starts to make sense.
A difficult network problem. A detection idea. A dataset waiting to become useful. Bring the challenge; we’ll define the right investigation or build.
Work through captures, conversations, and protocol state to explain unexpected network behaviour—including the relationship between link, network, transport, and application layers.
An annotated traffic analysis, reproducible findings, and a practical next step.
Investigate a problem ↗Turn network traffic into structured, queryable data. Design ingestion and transformations, connect security tools, and build detection logic that can be inspected and tested.
A working pipeline or detection prototype, with deployment notes and test evidence.
Build a pipeline ↗Connect packet-level understanding with data and model engineering. Explore feature extraction, traffic classification, intrusion-detection research, or an AI-assisted analysis workflow.
A scoped proof of concept, an evaluation plan, and documented data and model limitations.
Explore an idea ↗Build understanding through controlled experiments. Develop reproducible IT/OT lab scenarios, explain how attacks appear in traffic, and connect the observations to defensive action.
A lab, a technical workshop, or clear documentation your team can keep using.
Build understanding ↗$ decode --layer-by-layer
A network is a set of interacting protocols. Understanding the fields, state, and timing helps explain what a tool’s summary leaves out.
SELECT A LAYER
The network layer identifies the IP endpoints and the next protocol. The destination MAC can change at a router; the destination IP still identifies the remote endpoint.
A frame’s link-layer addresses and a packet’s IP addresses answer different questions.
That same reasoning connects packet analysis to useful features, interpretable detections, and better questions for a model.
Client delivery, security research, and practical training. Explore the supporting reports and work samples in my portfolio.
ATHENA SECURITY GROUP · MAY–JUN 2025
Built a Zeek → Filebeat → Logstash → Neo4j pipeline, with Ruby transformations and Cypher updates for connection, DNS, and HTTP logs.
Delivered: ingestion and graph construction. Graph-based anomaly detection was a future application.
Inspect the deployment notes ↗AI-IDS · INTRUSION DETECTION
Developed an XGBoost traffic classifier using CIC-IDS2017 flow data and packet-derived features. Wrote three Snort rules and validated alerts using Scapy-generated traffic, captures, and logs.
Academic implementation and comparison, with documented limitations.
Read the report & presentation ↗CANADIAN NUCLEAR LABORATORIES · INTERNSHIP · 2024
Built VMware ESXi/GNS3 industrial-control simulations with PLCs, HMIs, and engineering workstations for reproducible security testing and incident-response exercises.
Connected Cisco SPAN traffic mirroring with Tenable, Nozomi, and Elastic Stack in SOC training workflows. Configured FortiGate rules and developed detection exercises around reconnaissance, suspicious scripting, and man-in-the-middle behaviour.
Designed MITRE ATT&CK-aligned attack modules, Bash-based response workflows, and step-by-step guides. Delivered practical training for nuclear energy workers, connecting attack demonstrations to monitoring, investigation, and mitigation.
Work conducted in CNL’s cybersecurity training and simulation environment.
WASPLABS · UNIVERSITY OF WINDSOR · RESEARCH ASSISTANT · 2022–2023
Built a lab across three physical hosts, six VMs, and three VLANs, plus Docker-based cloud environments on Google Compute Engine and AWS. Crafted traffic with Scapy and C across link, network, transport, and application protocols; inspected it with Wireshark, tshark, and tcpdump. Automated captures with Bash for security datasets and machine-learning research.
CEC · CYBER CONSULTING INTERNSHIP · 2023
Analyzed remote terminal unit security requirements for Morocco’s Al-Wahda power plant project while working from Cairo. Compared vendor security features and procurement specifications, documented communication risks and firewall/VPN restrictions, and produced network diagrams and recommendations for management.
CEC subcontracted to SEPCO3 on the General Electric project. My role covered security analysis and recommendations.
Cybersecurity consultant
AI systems engineer
Computer science educator
My foundation is hands-on: crafting packets with Scapy and C, examining them with Wireshark, tshark, and tcpdump, and tracing how protocols interact across network layers.
I completed the SEEDLabs network-security course twice, reinforcing the fundamentals through packet construction and controlled experiments. That foundation carries into university security research, industrial-control simulations, and independent consulting. My wireless and hardware lab work also explores Wi-Fi behaviour and device interactions using personally owned equipment.
I bring the other half of the problem, too: building AI systems, transforming data, and evaluating what a model can actually support. In my AGORA research at Université de Tours, I built orchestration and retrieval over approximately 73,000 open-data catalogue records.
The value is connecting the details: what the traffic means, what the data preserves, and what a detection or model can reasonably conclude.
Explore the AI research ↗Start with a technical conversation. Agree the question, deliverables, access, and fees before the work begins.
Understand the environment, available captures or data, constraints, and what a useful answer looks like. Agree the scope and authorization for any testing.
Trace behaviour, test hypotheses, and develop the agreed analysis or prototype. Keep observations separate from assumptions and evaluate against the use case.
Walk through the findings, code, or pipeline. Deliver the agreed documentation, limitations, and next steps so your team understands the result.
A focused investigation of a network issue, a review of a capture or telemetry workflow, a detection proof of concept, or a technical workshop. We agree the deliverables and fees around the problem you want to solve.
Yes. We can assess the data, design extraction and feature pipelines, and build a prototype for a specific classification or detection question. Evaluation should consider representative traffic, data leakage, false positives, and how performance changes across environments.
Encryption protects payload contents. Depending on the protocol and capture point, timing, sizes, endpoints, transport behaviour, and visible handshake metadata can still support useful analysis. Payload inspection requires appropriate access to plaintext or decryption material; conclusions must stay within what the capture actually shows.
Yes. Teaching is part of how I work. My experience includes university teaching-assistant appointments, individual instruction, and cybersecurity training at Canadian Nuclear Laboratories. We can include a walkthrough or workshop in the agreed scope.
$ bring your hardest question
A puzzling capture, a new detection idea, or a network-data project. Tell me what you’re trying to understand or build.
[email protected]WINDSOR, CANADA · WORKING REMOTELY