Projects & case studies
Architecture stories with enough detail to be useful.
A selected set of enterprise, research, and platform projects showing
the business problem, architecture choices, technology stack, system
flow, security and scalability thinking, and public links where
permitted.
9case studies
2enterprise cases
6research cases
Includes one research tool: PaperHarbor. Enterprise delivery details
are intentionally anonymized where project
data, customer context, demos, or production metrics are private.
Enterprise AI architecture
Agentic AI delivery workflow for enterprise software
Built around slow enterprise implementation cycles, fragmented
requirements, manual documentation, and repeated handoffs across
discovery, specification, configuration, development,
validation, and testing.
Business problem
Delivery teams lose context between business discovery,
technical specification, configuration, generated artifacts,
validation, and testing. That creates repeated clarification
loops and weak traceability from requirement to shipped work.
Technology stack
Agentic AIRAGServiceNowPythonLLM guardrailsTest automationSaaS integrations
Architectural decisions
-
Split the workflow into specialized discovery, developer,
decision, validation, and testing agent responsibilities.
-
Used enterprise knowledge retrieval so specifications and
generated artifacts stay traceable to source context.
-
Added human review points for governance-sensitive outputs.
Security and scalability considerations
- Scoped data access and traceable retrieval grounding.
- Audit trails for agent-generated artifacts.
- Reusable agent patterns for multiple SaaS workflows.
-
Review gates for high-risk or customer-facing changes.
Business inputsKnowledge layerAgent orchestrationServiceNow / SaaSValidation & testing
Platform engineering
ServiceNow solution design and R&D enablement
Supported enterprise teams that needed clearer platform
architecture, stronger RFP solution narratives, and maintainable
internal applications across ServiceNow and AI/ML use cases.
Business problem
Teams needed a bridge between business expectations,
ServiceNow platform capabilities, internal R&D
applications, and implementation-ready technical guidance.
Technology stack
ServiceNowPythonAI/MLITSMRFP architectureTechnical training
Architectural decisions
-
Converted business requirements into platform workflows,
application structures, and implementation-ready
documentation.
-
Kept reusable architecture patterns separate from
customer-specific configuration.
-
Combined hands-on delivery with mentoring so platform
knowledge did not stay isolated.
Security and scalability considerations
- Role-aware workflow and instance governance thinking.
-
Reusable design assets for repeated solution patterns.
- Operational documentation for maintainability.
-
Clear boundaries between configuration and customization.
Business needArchitecture blueprintServiceNow workflowIntegration planDelivery enablement
Research tooling
PaperHarbor: scholarly PDF discovery and archiving
Finds available open-access papers and saves an organized PDF
collection through a local web interface or command line.
Research workflow problem
Collecting full texts across a bibliography requires repeated
searches, downloads, and file naming. PaperHarbor accepts
individual DOIs or URLs, Zotero libraries, BibTeX, and CSL-JSON.
Technology stack
PythonRequestsBeautiful Soup
pypdfSQLiteZotero Web APICSV
Architectural decisions
- Separate reference readers, provider aggregation, landing-page resolution, downloads, and reporting in a shared pipeline.
- Use conditional provider fallbacks, deduplicate candidate URLs, and reject conflicting DOI matches.
- Validate PDF headers and download sizes before saving files with configurable names.
- Record each outcome and its attempt history in CSV for targeted retries and manual follow-up.
Data handling and limitations
The web server binds to localhost. Zotero database reads use a
temporary copy; downloads go to a separate folder. Existing
PDFs are skipped by default. Availability depends on source
access; blocked downloads include manual follow-up links.
Researcher experience
Load an individual DOI or URL, local Zotero database, BibTeX or CSL-JSON export, personal or group API library, or a previous report. The browser interface supports reference search, collection filtering, selection, progress, and logs; the CLI supports repeatable batches.
Reliability and recovery
Skip existing PDFs, reuse duplicate DOI outcomes within a run, and continue after individual reference errors. Transient downloads use bounded retries. Unresolved results retain diagnostic notes, suggested filenames, and recovery actions.
ReferencesPDF discovery
ValidationLocal archiveCSV report
Latest research · arXiv preprint · October 2026
CyberHull: Deterministic Malicious URL Isolation via Convex Hull
Explores inspectable URL classification through geometric boundaries learned from legitimate web features.
Research problemChanging phishing infrastructure can evade static lists. The study investigates a CPU-based detection approach with explicit decision boundaries.
Technology stackPythonSciPy SpatialNumPyPandasComputational geometry
MethodExtract content, semantic, and hyperlink features; rank feature pairs; construct QuickHull vaults; classify new URLs using containment tests.
Scope and limitationsBoundary quality depends on clean baseline data and complete feature extraction. Legitimate website changes require recalibration, and broader traffic validation remains future work.
Web featuresFeature-pair selectionConvex hull vaultsContainment checksURL decision
Signed-network research · arXiv 2026
SiNMULI: signed-network malicious URL identification
Reframed malicious URL identification as structural inference
over the web’s hyperlink relationships, creating an
interpretable alternative to blacklists and opaque learned
classifiers.
Research problem
Static lists miss new threats, while lexical and content-based
models can depend on labeled data and signals that attackers
can alter. The project asks whether trust and distrust patterns
between linked sites can expose malicious domains.
Technology stack
Signed networksGraph theorySocial balance theoryWeb crawlingPython
Architectural decisions
-
Modeled websites as nodes and hyperlinks as directed signed
edges.
-
Used strong and weak balance constraints to infer missing
signs within directed triads.
-
Classified unseen domains with a transparent 51% majority
rule over incoming edge signs.
Security and scalability considerations
- Rule-based explanations instead of opaque model scores.
- No classifier training or retraining for new domains.
-
Sparse-graph processing over 48,205 nodes and 384,592 edges.
-
Explicit handling of low-evidence domains through an unknown
outcome.
Seed URLsHyperlink crawlSigned graphBalance inference51% classification
IEEE TENSYMP 2026 · Cybersecurity ML
ASTriA: scalable semi-supervised malicious URL detection
Explores how a lightweight semi-supervised learning workflow can
identify malicious URLs when extensive, up-to-date labeled data
is difficult and expensive to obtain.
Research problem
Newly generated malicious URLs can evade blacklists, while
collecting enough current, reliable labels for supervised
training remains costly and time-consuming.
Technology stack
Semi-supervised learningTri-learningPseudo-labelingRandom Forestk-Nearest NeighborsURL features
Architectural decisions
-
Expanded a small labeled seed set by iteratively selecting
high-confidence pseudo-labels from an unlabeled URL pool.
-
Used lightweight lexical and host-based features to balance
detection quality with practical efficiency.
-
Kept the classification workflow interpretable through
familiar models including Random Forest and k-Nearest
Neighbors.
Security and scalability considerations
- Reduces dependence on manually labeled URL datasets.
- Targets newly generated URLs beyond static blacklists.
- Uses computationally lightweight URL representations.
-
Limits pseudo-label expansion to high-confidence samples.
Labeled URLsUnlabeled URL poolHigh-confidence pseudo-labelsTri-learning classifiersURL decision
Cybersecurity research
CAIRN: causal active inference for cyber attack diagnosis
Addressed alert-heavy security operations where correlation
alone makes it difficult to explain what is happening, choose
safe interventions, and confirm competing attack hypotheses.
Business problem
IDS and SIEM workflows can produce many alerts without enough
causal clarity. Analysts need interpretable evidence paths and
low-risk ways to confirm or reject competing attack
explanations.
Technology stack
Bayesian inferenceCausal graphsCyber telemetryGenAI-assisted CTIPython
Architectural decisions
-
Modeled telemetry as a probabilistic causal evidence graph.
-
Used Bayesian inference to compare attack explanations in
real time.
-
Added an active intervention loop for probes, logging,
decoys, and scoped isolation.
Security and scalability considerations
- Low-risk interventions before disruptive response.
- Explainable evidence paths for analyst review.
-
Scoped response actions tied to uncertainty reduction.
- Graph-based reasoning over evolving telemetry.
TelemetryCausal graphBayesian diagnosisIntervention policyResponse decision
Trustworthy ML benchmark
EntroURL-Bench for malicious URL detection
Tackled the problem of evaluating malicious-URL classifiers on
aging or shallow datasets that do not represent modern phishing,
malware, and malicious web behavior well enough.
Business problem
Security teams and researchers need reliable benchmarks for
malicious URL detection. Weak or outdated datasets make it
harder to compare models, reason about trustworthiness, and
study modern phishing and malware behavior.
Technology stack
Machine learningURL featuresSecurity datasetsBenchmarkingTrustworthy AI
Architectural decisions
-
Focused the benchmark on richer URL representations rather
than only lexical surface features.
-
Framed the dataset around reproducible comparison and model
trustworthiness.
-
Connected the project to broader security-evaluation needs
for phishing and malware detection.
Security and scalability considerations
- Consistent benchmark structure for reproducibility.
- Feature-rich representation for modern URL analysis.
- Extensible evaluation pattern for future research.
-
Trustworthiness framing beyond raw classifier accuracy.
Raw URLsFeature extractionBenchmark datasetModel evaluationTrust analysis
Environmental computing · IJARCCE 2022
Carbon loss estimation: a case study of Little Andaman development plan
Combines satellite land-cover observations and forest inventory data to estimate carbon stock affected by a historical development scenario.
Research problemEstimate the carbon implications of forest conversion in the Little Andaman proposal examined in the 2022 paper.
Technology stackQGISBhuvanRemote sensingLand-cover analysisCarbon accounting
MethodMap four forest classes from sampled land-cover areas, scale regional carbon densities to the study area, and aggregate five carbon pools.
Scope and limitationsThe source contains inconsistent area and unit labels. The detailed page records these limits; the result is not a measurement of present-day emissions.
Land-cover dataForest classesCarbon inventoriesArea scalingStock estimate