Context
The environment
Traditional pipeline checks identify known weaknesses but can miss unusual behavior and multi-step attack patterns that only become visible across events.
Problem
What needed to change
Combine preventive scanning, centralized telemetry, and behavioral models into one explainable pipeline-security workflow.
Constraints
- Security signals originated from multiple pipeline stages and tools.
- Models needed structured event sequences and feedback for useful monitoring.
- The project needed to distinguish research findings from production claims.
Contribution
My responsibility
- Pipeline threat model and security architecture
- ELK log ingestion and visualization
- Isolation Forest, DeepLog, and Transformer experiments
- SAST, dependency, and container scanning integration
- Monitoring and feedback workflow
Approach
How I structured the work
Collect the pipeline trail
Use Filebeat, Logstash, Elasticsearch, and Kibana to normalize and visualize events across the delivery workflow.
Layer known and behavioral checks
Combine conventional scanning controls with anomaly and sequence models so the design covers both known weaknesses and unusual execution patterns.
Create a feedback loop
Correlate events, review model output, and feed validated signals back into monitoring and model iteration.
Evidence
A safe view of the system
ELK telemetry & correlation
CI/CD events
Security scans
Behavior models
Review & feedback
Outcome
What the work established
- Integrated preventive scans with centralized pipeline telemetry.
- Explored anomaly and multi-step pattern detection across CI/CD events.
- Produced an end-to-end monitoring and feedback design for continued model iteration.