Projects & case studies

Architecture stories with enough detail to be useful.

A selected set of enterprise, research, and platform projects showing the business problem, architecture choices, technology stack, system flow, security and scalability thinking, and public links where permitted.

9case studies
2enterprise cases
6research cases

Includes one research tool: PaperHarbor. Enterprise delivery details are intentionally anonymized where project data, customer context, demos, or production metrics are private.

Enterprise AI architecture

Agentic AI delivery workflow for enterprise software

Built around slow enterprise implementation cycles, fragmented requirements, manual documentation, and repeated handoffs across discovery, specification, configuration, development, validation, and testing.

Business problem

Delivery teams lose context between business discovery, technical specification, configuration, generated artifacts, validation, and testing. That creates repeated clarification loops and weak traceability from requirement to shipped work.

Technology stack
Agentic AIRAGServiceNowPythonLLM guardrailsTest automationSaaS integrations
Architectural decisions
  • Split the workflow into specialized discovery, developer, decision, validation, and testing agent responsibilities.
  • Used enterprise knowledge retrieval so specifications and generated artifacts stay traceable to source context.
  • Added human review points for governance-sensitive outputs.
Security and scalability considerations
  • Scoped data access and traceable retrieval grounding.
  • Audit trails for agent-generated artifacts.
  • Reusable agent patterns for multiple SaaS workflows.
  • Review gates for high-risk or customer-facing changes.
Business inputsKnowledge layerAgent orchestrationServiceNow / SaaSValidation & testing

Platform engineering

ServiceNow solution design and R&D enablement

Supported enterprise teams that needed clearer platform architecture, stronger RFP solution narratives, and maintainable internal applications across ServiceNow and AI/ML use cases.

Business problem

Teams needed a bridge between business expectations, ServiceNow platform capabilities, internal R&D applications, and implementation-ready technical guidance.

Technology stack
ServiceNowPythonAI/MLITSMRFP architectureTechnical training
Architectural decisions
  • Converted business requirements into platform workflows, application structures, and implementation-ready documentation.
  • Kept reusable architecture patterns separate from customer-specific configuration.
  • Combined hands-on delivery with mentoring so platform knowledge did not stay isolated.
Security and scalability considerations
  • Role-aware workflow and instance governance thinking.
  • Reusable design assets for repeated solution patterns.
  • Operational documentation for maintainability.
  • Clear boundaries between configuration and customization.
Business needArchitecture blueprintServiceNow workflowIntegration planDelivery enablement

Research tooling

PaperHarbor: scholarly PDF discovery and archiving

Finds available open-access papers and saves an organized PDF collection through a local web interface or command line.

Research workflow problem

Collecting full texts across a bibliography requires repeated searches, downloads, and file naming. PaperHarbor accepts individual DOIs or URLs, Zotero libraries, BibTeX, and CSL-JSON.

Technology stack
PythonRequestsBeautiful Soup pypdfSQLiteZotero Web APICSV
Architectural decisions
  • Separate reference readers, provider aggregation, landing-page resolution, downloads, and reporting in a shared pipeline.
  • Use conditional provider fallbacks, deduplicate candidate URLs, and reject conflicting DOI matches.
  • Validate PDF headers and download sizes before saving files with configurable names.
  • Record each outcome and its attempt history in CSV for targeted retries and manual follow-up.
Data handling and limitations

The web server binds to localhost. Zotero database reads use a temporary copy; downloads go to a separate folder. Existing PDFs are skipped by default. Availability depends on source access; blocked downloads include manual follow-up links.

Researcher experience

Load an individual DOI or URL, local Zotero database, BibTeX or CSL-JSON export, personal or group API library, or a previous report. The browser interface supports reference search, collection filtering, selection, progress, and logs; the CLI supports repeatable batches.

Reliability and recovery

Skip existing PDFs, reuse duplicate DOI outcomes within a run, and continue after individual reference errors. Transient downloads use bounded retries. Unresolved results retain diagnostic notes, suggested filenames, and recovery actions.

ReferencesPDF discovery ValidationLocal archiveCSV report

Latest research · arXiv preprint · October 2026

CyberHull: Deterministic Malicious URL Isolation via Convex Hull

Explores inspectable URL classification through geometric boundaries learned from legitimate web features.

Research problem

Changing phishing infrastructure can evade static lists. The study investigates a CPU-based detection approach with explicit decision boundaries.

Technology stack
PythonSciPy SpatialNumPyPandasComputational geometry
Method

Extract content, semantic, and hyperlink features; rank feature pairs; construct QuickHull vaults; classify new URLs using containment tests.

Scope and limitations

Boundary quality depends on clean baseline data and complete feature extraction. Legitimate website changes require recalibration, and broader traffic validation remains future work.

Web featuresFeature-pair selectionConvex hull vaultsContainment checksURL decision

Signed-network research · arXiv 2026

SiNMULI: signed-network malicious URL identification

Reframed malicious URL identification as structural inference over the web’s hyperlink relationships, creating an interpretable alternative to blacklists and opaque learned classifiers.

Research problem

Static lists miss new threats, while lexical and content-based models can depend on labeled data and signals that attackers can alter. The project asks whether trust and distrust patterns between linked sites can expose malicious domains.

Technology stack
Signed networksGraph theorySocial balance theoryWeb crawlingPython
Architectural decisions
  • Modeled websites as nodes and hyperlinks as directed signed edges.
  • Used strong and weak balance constraints to infer missing signs within directed triads.
  • Classified unseen domains with a transparent 51% majority rule over incoming edge signs.
Security and scalability considerations
  • Rule-based explanations instead of opaque model scores.
  • No classifier training or retraining for new domains.
  • Sparse-graph processing over 48,205 nodes and 384,592 edges.
  • Explicit handling of low-evidence domains through an unknown outcome.
Seed URLsHyperlink crawlSigned graphBalance inference51% classification

IEEE TENSYMP 2026 · Cybersecurity ML

ASTriA: scalable semi-supervised malicious URL detection

Explores how a lightweight semi-supervised learning workflow can identify malicious URLs when extensive, up-to-date labeled data is difficult and expensive to obtain.

Research problem

Newly generated malicious URLs can evade blacklists, while collecting enough current, reliable labels for supervised training remains costly and time-consuming.

Technology stack
Semi-supervised learningTri-learningPseudo-labelingRandom Forestk-Nearest NeighborsURL features
Architectural decisions
  • Expanded a small labeled seed set by iteratively selecting high-confidence pseudo-labels from an unlabeled URL pool.
  • Used lightweight lexical and host-based features to balance detection quality with practical efficiency.
  • Kept the classification workflow interpretable through familiar models including Random Forest and k-Nearest Neighbors.
Security and scalability considerations
  • Reduces dependence on manually labeled URL datasets.
  • Targets newly generated URLs beyond static blacklists.
  • Uses computationally lightweight URL representations.
  • Limits pseudo-label expansion to high-confidence samples.
Labeled URLsUnlabeled URL poolHigh-confidence pseudo-labelsTri-learning classifiersURL decision

Cybersecurity research

CAIRN: causal active inference for cyber attack diagnosis

Addressed alert-heavy security operations where correlation alone makes it difficult to explain what is happening, choose safe interventions, and confirm competing attack hypotheses.

Business problem

IDS and SIEM workflows can produce many alerts without enough causal clarity. Analysts need interpretable evidence paths and low-risk ways to confirm or reject competing attack explanations.

Technology stack
Bayesian inferenceCausal graphsCyber telemetryGenAI-assisted CTIPython
Architectural decisions
  • Modeled telemetry as a probabilistic causal evidence graph.
  • Used Bayesian inference to compare attack explanations in real time.
  • Added an active intervention loop for probes, logging, decoys, and scoped isolation.
Security and scalability considerations
  • Low-risk interventions before disruptive response.
  • Explainable evidence paths for analyst review.
  • Scoped response actions tied to uncertainty reduction.
  • Graph-based reasoning over evolving telemetry.
TelemetryCausal graphBayesian diagnosisIntervention policyResponse decision

Trustworthy ML benchmark

EntroURL-Bench for malicious URL detection

Tackled the problem of evaluating malicious-URL classifiers on aging or shallow datasets that do not represent modern phishing, malware, and malicious web behavior well enough.

Business problem

Security teams and researchers need reliable benchmarks for malicious URL detection. Weak or outdated datasets make it harder to compare models, reason about trustworthiness, and study modern phishing and malware behavior.

Technology stack
Machine learningURL featuresSecurity datasetsBenchmarkingTrustworthy AI
Architectural decisions
  • Focused the benchmark on richer URL representations rather than only lexical surface features.
  • Framed the dataset around reproducible comparison and model trustworthiness.
  • Connected the project to broader security-evaluation needs for phishing and malware detection.
Security and scalability considerations
  • Consistent benchmark structure for reproducibility.
  • Feature-rich representation for modern URL analysis.
  • Extensible evaluation pattern for future research.
  • Trustworthiness framing beyond raw classifier accuracy.
Raw URLsFeature extractionBenchmark datasetModel evaluationTrust analysis

Environmental computing · IJARCCE 2022

Carbon loss estimation: a case study of Little Andaman development plan

Combines satellite land-cover observations and forest inventory data to estimate carbon stock affected by a historical development scenario.

Research problem

Estimate the carbon implications of forest conversion in the Little Andaman proposal examined in the 2022 paper.

Technology stack
QGISBhuvanRemote sensingLand-cover analysisCarbon accounting
Method

Map four forest classes from sampled land-cover areas, scale regional carbon densities to the study area, and aggregate five carbon pools.

Scope and limitations

The source contains inconsistent area and unit labels. The detailed page records these limits; the result is not a measurement of present-day emissions.

Land-cover dataForest classesCarbon inventoriesArea scalingStock estimate