Security Engineer @Huawei

Building VitaeContext:
https://github.com/vitaecontext/vitaecontext

Renato Mignone  • Peerlist

Designed and implemented a 𝗺𝘂𝗹𝘁𝗶-𝗺𝗼𝗱𝗲𝗹 𝗔𝗜 𝗱𝗲𝗳𝗲𝗻𝗰𝗲 𝘀𝘂𝗶𝘁𝗲 covering the full spectrum of AI-powered cybersecurity, structured as four end-to-end research modules with individual repositories linked as Git submodules. 1) 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗙𝗹𝗼𝘄 𝗖𝗹𝗮𝘀𝘀𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 (Deep Learning) Built a deep learning pipeline on the CICIDS2017 dataset to classify 𝗯𝗲𝗻𝗶𝗴𝗻 𝘃𝘀 𝗺𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗳𝗹𝗼𝘄𝘀. Investigated class imbalance with weighted loss functions, conducted 𝗳𝗲𝗮𝘁𝘂𝗿𝗲-𝗯𝗶𝗮𝘀 𝗮𝗻𝗮𝗹𝘆𝘀𝗶𝘀 (destination port shortcuts in BruteForce attacks), and performed hyperparameter sweeps across FFNN architectures with SGD, SGD+momentum, and AdamW optimisers. 2)𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗔𝗣𝗜-𝗖𝗮𝗹𝗹 𝗖𝗹𝗮𝘀𝘀𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 Classified malware families from dynamic API-call execution traces using 𝗙𝗙𝗡𝗡𝘀, 𝗥𝗡𝗡𝘀, 𝗟𝗦𝗧𝗠𝘀, and Graph Neural Networks (𝗚𝗿𝗮𝗽𝗵𝗦𝗔𝗚𝗘, 𝗚𝗖𝗡). Represented execution traces as directed graphs to extract structural behavioural features. Achieved 𝟵𝟴.𝟭% classification accuracy. 3) 𝗨𝗻𝘀𝘂𝗽𝗲𝗿𝘃𝗶𝘀𝗲𝗱 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗜𝗻𝘁𝗿𝘂𝘀𝗶𝗼𝗻 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 Detected zero-day network attacks with no labelled attack data, using One-Class SVM, 𝗔𝘂𝘁𝗼𝗲𝗻𝗰𝗼𝗱𝗲𝗿-𝗯𝗮𝘀𝗲𝗱 𝗮𝗻𝗼𝗺𝗮𝗹𝘆 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 (reconstruction error), DBSCAN/K-Means clustering, and t-SNE/PCA for visualisation. Achieved 95% precision on the NSL-KDD dataset. 4) 𝗡𝗟𝗣 𝗳𝗼𝗿 𝗠𝗜𝗧𝗥𝗘 𝗔𝗧𝗧&𝗖𝗞 𝗧𝗮𝗰𝘁𝗶𝗰 𝗥𝗲𝗰𝗼𝗴𝗻𝗶𝘁𝗶𝗼𝗻 Classified real-world 𝗯𝗮𝘀𝗵 𝗰𝗼𝗺𝗺𝗮𝗻𝗱 𝘀𝗲𝘀𝘀𝗶𝗼𝗻𝘀 into MITRE ATT&CK tactics (Discovery, Execution, Persistence, Defence Evasion) using TF-IDF, Word2Vec, Bidirectional LSTMs/GRUs, Transformers (BERT, UniXcoder) 𝗥𝗲𝗽𝗼 𝗨𝗥𝗟: https://github.com/RenatoMignone/AI-Driven-Threat-Detection-Research

AI-Driven Threat Detection Research

𝗕𝗮𝗰𝗵𝗲𝗹𝗼𝗿'𝘀 𝗧𝗵𝗲𝘀𝗶𝘀 - Università degli Studi del Sannio Designed and developed an automated malware analysis pipeline to detect undisclosed, potentially harmful behaviours in trusted software (𝗴𝗼𝗼𝗱𝘄𝗮𝗿𝗲) - a critical problem in the context of 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝘀𝘂𝗽𝗽𝗹𝘆 𝗰𝗵𝗮𝗶𝗻 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆. Defined a novel classification framework of 𝟭𝟮 𝗘𝗾𝘂𝗶𝘃𝗼𝗰𝗮𝗹 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗕𝗲𝗵𝗮𝘃𝗶𝗼𝘂𝗿𝘀 (𝗘𝗦𝗕𝘀) mapped to the MITRE ATT&CK Enterprise Matrix, covering techniques such as 𝘀𝘆𝘀𝘁𝗲𝗺 𝗿𝗲𝗰𝗼𝗻𝗻𝗮𝗶𝘀𝘀𝗮𝗻𝗰𝗲, 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 𝗺𝗮𝗻𝗶𝗽𝘂𝗹𝗮𝘁𝗶𝗼𝗻, 𝗱𝗲𝗳𝗲𝗻𝗰𝗲 𝗲𝘃𝗮𝘀𝗶𝗼𝗻, and 𝗰𝗼𝘃𝗲𝗿𝘁 𝗺𝗲𝗱𝗶𝗮 𝗰𝗮𝗽𝘁𝘂𝗿𝗲. Built a Python-based orchestration tool with an 𝗮𝘀𝘆𝗻𝗰𝗵𝗿𝗼𝗻𝗼𝘂𝘀, 𝗺𝘂𝗹𝘁𝗶𝘁𝗵𝗿𝗲𝗮𝗱𝗲𝗱 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 that automated parallel binary submissions to multiple commercial and open-source sandboxes via REST APIs: - 𝗛𝘆𝗯𝗿𝗶𝗱 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀 (Falcon Sandbox) - static + dynamic analysis on Windows 10/11 - 𝗩𝗶𝗿𝘂𝘀𝗧𝗼𝘁𝗮𝗹 - integrated with CAPA (Mandiant/FLARE), CAPE, and ZENBOX - 𝗔𝗡𝗬.𝗥𝗨𝗡 - real-time interactive detonation with PCAP and memory dump collection Analysed 𝟯𝟲 𝗴𝗼𝗼𝗱𝘄𝗮𝗿𝗲 𝗯𝗶𝗻𝗮𝗿𝗶𝗲𝘀 across 𝟲 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗰𝗮𝘁𝗲𝗴𝗼𝗿𝗶𝗲𝘀. Results revealed that 𝟭𝟬𝟬% of samples exhibited covert reconnaissance and OS-level exploitation behaviours (ESB1, ESB6), demonstrating that widely trusted software, including major browsers and streaming platforms, silently performs actions consistent with malware TTPs in the absence of vendor-declared 𝗦𝗕𝗢𝗠𝘀 (Software Bill of Materials). Data post-processing and ESB mapping performed with Pandas and Seaborn in Jupyter Notebooks.

Bachelor Degree Thesis

Extracting Equivocal Behaviours from Trusted 

Conducted 𝗼𝗳𝗳𝗲𝗻𝘀𝗶𝘃𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵 on the Linux kernel's 𝗲𝗕𝗣𝗙 (extended Berkeley Packet Filter) verifier, the security gatekeeper (~20,000 lines of code) that statically analyses every 𝗲𝗕𝗣𝗙 𝗽𝗿𝗼𝗴𝗿𝗮𝗺 before allowing execution in ring 0. The project built on a prior team's theoretical vulnerability assessment (𝗜𝗦𝗢-𝗜𝗘𝗖 𝗧𝗦 𝟭𝟳𝟵𝟲𝟭-𝟮𝟬𝟭𝟯 𝗖 𝗦𝗲𝗰𝘂𝗿𝗲 𝗖𝗼𝗱𝗶𝗻𝗴 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱), which had identified ~60 vulnerability candidates in the 𝗫𝗗𝗣 𝗦𝘆𝗻𝗣𝗿𝗼𝘅𝘆 kernel implementation and classified 9 as exploitable and 12 as having limited exploitability after passing the verifier unchecked. 𝗠𝘆 𝗰𝗼𝗻𝘁𝗿𝗶𝗯𝘂𝘁𝗶𝗼𝗻: bridging the gap from theory to working exploits. Analysed verifier logic bugs across three exploitation primitive classes, 𝗢𝘂𝘁-𝗼𝗳-𝗕𝗼𝘂𝗻𝗱𝘀 𝗥𝗲𝗮𝗱 (OOB-R), 𝗢𝘂𝘁-𝗼𝗳-𝗕𝗼𝘂𝗻𝗱𝘀 𝗪𝗿𝗶𝘁𝗲 (OOB-W), and 𝗧𝘆𝗽𝗲 𝗖𝗼𝗻𝗳𝘂𝘀𝗶𝗼𝗻, with demonstrated paths to arbitrary kernel memory access and Local Privilege Escalation (LPE) to root. 𝗠𝗲𝘁𝗵𝗼𝗱𝗼𝗹𝗼𝗴𝘆: Multi-stage analysis pipeline: 𝗖 𝘀𝗼𝘂𝗿𝗰𝗲 →𝗲𝗕𝗣𝗙 𝗯𝘆𝘁𝗲𝗰𝗼𝗱𝗲 (llvm-objdump -d) → 𝘁𝗿𝗮𝗻𝘀𝗹𝗮𝘁𝗲𝗱 𝗶𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝗶𝗼𝗻𝘀 (bpftool prog dump xlated) → 𝗿𝘂𝗻𝘁𝗶𝗺𝗲 𝘁𝗿𝗮𝗰𝗲𝘀 (GDB over QEMU). Kernel emulation on Linux LTS 6.8 using 𝗤𝗘𝗠𝗨/𝗞𝗩𝗠 with custom cloud-init provisioned 𝗨𝗯𝘂𝗻𝘁𝘂 𝟮𝟰.𝟬𝟰 𝗩𝗠𝘀 Vulnerability injection via 𝗴𝗶𝘁 𝗮𝗽𝗽𝗹𝘆 𝗽𝗮𝘁𝗰𝗵𝗲𝘀s into xdp_synproxy_kern.c (real Linux kernel selftests code) Full client-server test topology simulating 𝗿𝗲𝗮𝗹 𝗻𝗲𝘁𝘄𝗼𝗿𝗸-𝗹𝗲𝘃𝗲𝗹 𝗮𝘁𝘁𝗮𝗰𝗸 𝘃𝗲𝗰𝘁𝗼𝗿𝘀 𝘃𝗶𝗮 𝗫𝗗𝗣. 𝗥𝗲𝘀𝘂𝗹𝘁𝘀: 5 confirmed exploitable vulnerabilities, with functional 𝗽𝗿𝗼𝗼𝗳-𝗼𝗳-𝗰𝗼𝗻𝗰𝗲𝗽𝘁 𝗲𝘅𝗽𝗹𝗼𝗶𝘁𝘀 demonstrating verifier logic bypass and kernel privilege escalation paths.

Linux eBPF Verifier Bypass Research - Practic

Project Based University Course, its aim was to let us understand and learn the structure of the Internet Protocol, the web communication and the resource management. Through a series of hands-on projects, I learned how to build a secure and optimized web server from scratch. This involved understanding the security vulnerabilities inherent in web servers and implementing measures to mitigate these risks

Network Systems Programming

In this project, we 𝐝𝐞𝐯𝐞𝐥𝐨𝐩𝐞𝐝 𝐚 𝐟𝐮𝐥𝐥 𝐞𝐦𝐮𝐥𝐚𝐭𝐢𝐨𝐧 of the 𝐍𝐗𝐏 𝐒𝟑𝟐𝐊𝟑𝟓𝟖𝐄𝐕𝐁 board in 𝐐𝐄𝐌𝐔 (an open-source machine emulator and virtualizer) , ported 𝐅𝐫𝐞𝐞𝐑𝐓𝐎𝐒 (a lightweight real-time operating system) to run on this emulated board and developed a secure timeout system with 𝐡𝐚𝐫𝐝𝐰𝐚𝐫𝐞 𝐭𝐢𝐦𝐞𝐫𝐬 and 𝐔𝐀𝐑𝐓 communication. This allowed us to simulate and test real-time embedded applications in a controlled environment. Key accomplishments: -  𝐐𝐄𝐌𝐔-𝐛𝐚𝐬𝐞𝐝 𝐛𝐨𝐚𝐫𝐝 𝐞𝐦𝐮𝐥𝐚𝐭𝐢𝐨𝐧: Designed and implemented an emulated version of the NXP S32K358EVB board, for rapid prototyping and bypassing hardware dependencies. -  𝐅𝐫𝐞𝐞𝐑𝐓𝐎𝐒 𝐢𝐧𝐭𝐞𝐠𝐫𝐚𝐭𝐢𝐨𝐧: Achieved efficient real-time task scheduling for embedded applications. - 𝐇𝐚𝐫𝐝𝐰𝐚𝐫𝐞 𝐭𝐢𝐦𝐞𝐫 𝐢𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭𝐚𝐭𝐢𝐨𝐧: Precise interrupt-driven timing for critical operations. - 𝐔𝐀𝐑𝐓 𝐜𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐬𝐞𝐭𝐮𝐩: Streamlined debugging and external device interaction. -  𝐌𝐞𝐦𝐨𝐫𝐲 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐔𝐧𝐢𝐭 (𝐌𝐏𝐔) 𝐜𝐨𝐧𝐟𝐢𝐠𝐮𝐫𝐚𝐭𝐢𝐨𝐧: Enhanced security and system stability through hardware-enforced policies. 📌 The full project documentation is available on GitHub, including a step-by-step setup guide to reproduce the emulation and deployment. 𝐑𝐞𝐩𝐨 𝐋𝐢𝐧𝐤: https://github.com/RenatoMignone/Secure-Timeout-System-NXPS32K3X8EVB

Secure-Timeout-System-NXPS32K3X8EVB

Designed and deployed a realistic “𝐈𝐧𝐭𝐞𝐫𝐧𝐞𝐭-𝐥𝐢𝐤𝐞" network in 𝐆𝐍𝐒𝟑 and 𝐃𝐨𝐜𝐤𝐞𝐫 to interconnect two remote LANs (10.0.1.0/24 ↔ 10.0.2.0/24) via 𝐬𝐢𝐭𝐞-𝐭𝐨-𝐬𝐢𝐭𝐞 𝐕𝐏𝐍. Leveraged 𝐒𝐨𝐟𝐭𝐄𝐭𝐡𝐞𝐫’𝐬 multi-protocol support to build and compare: - 𝐈𝐏𝐒𝐞𝐜 𝐕𝐏𝐍 (StrongSwan Client) - 𝐓𝐋𝐒-𝐕𝐏𝐍 (OpenVPN Client) Configured 𝐍𝐀𝐓/𝐏𝐀𝐓 port-forwarding, and SoftEther 𝐒𝐞𝐜𝐮𝐫𝐞𝐍𝐀𝐓 for seamless connectivity. Conducted packet-level analysis with Wireshark to validate key exchanges, encryption integrity, and performance trade-offs—gaining hands-on expertise in VPN architecture, NAT traversal, and network security design 𝐑𝐞𝐩𝐨 𝐔𝐑𝐋𝐬: https://github.com/RenatoMignone/SoftEther-VPN-LabActivity https://github.com/RenatoMignone/SoftEther-VPN-Guardian https://github.com/RenatoMignone/SoftEtherVPN-Configuration-FIles

SoftEther VPN Project

Project for Machine Learning for Networking Exam @ Polito - SSH Shell Attacks Analysis: a project to classify attacker tactics and identify patterns in 230,000 honeypot-captured Unix shell attacks using MITRE ATT&CK framework and ML techniques. This project is part of the Machine Learning for Networking course at Politecnico di Torino. It focuses on analyzing SSH shell attack sessions recorded from honeypot deployments to classify attacker intents and explore underlying patterns. Objectives: 1. Data Exploration: Analyze temporal trends, extract numerical features, and evaluate intent distributions. 2. Classification: Automatically identify and assign attacker intents to each SSH attack session. 3. Clustering: Group similar attack sessions to uncover attack patterns and fine-grained categories. 4. Language Models: Explore advanced NLP techniques like BERT and Doc2Vec for improved classification performance.

SSH-Shell-Attacks

VitaeContext is an open-source, local-first context layer for career-related AI work. AI agents usually begin without knowing which professional facts are current, which claims have evidence, what the user is trying to achieve, or which information should remain private. VitaeContext helps users maintain one reusable Career Context file containing verified facts, goals, constraints, evidence links, and claims that should not be made. That context can then be reused across different agents and professional workflows without repeatedly explaining the same career history.It includes focused Agent Skills for:• Building and maintaining Career Context • CV and ATS optimization • LinkedIn profiles • GitHub profiles and repositories • Web portfolios • X/Twitter positioning • Structured professional memory through VitaeGraphVitaeContext supports Codex, Claude Code, Gemini CLI, OpenCode, and portable Agent Skills environments.Career information remains in local Markdown files controlled by the user.Quick start: npx vitaecontext install --provider codex npx vitaecontext doctor VitaeContext is MIT licensed and was previously known as AgentKit SEO.

VitaeContext

During the bachelor degree i managed the backend side of a web application, the university gave us a private server on a Linux VM only reachable thanks to a VPN. During this project i used:  java, spring boot spring security and other java's frameworks, maven to manage the java project build, github and gitlab to manage our code, Docker containers to let our code be builded and sended to our server, MongoDB to manage datas of our users (private gitlab repo)

Renato Mignone

Security Engineer @Huawei Building VitaeContext: https://github.com/vitaecontext/vitaecontext