Jielin Wong

Threat Intelligence Platform is a monitoring platform based on open-source threat intelligence implementation and Django. I independently implemented all the features, including the front and back ends.

MAIN FEATURES
• Getting the IPs in traffic monitoring and comparing them with the malicious IP list.
• Getting the traffic monitoring access domain and comparing it with the domain in the open-source threat intelligence.
• Implementing a timing task agent based on Celery, which is used to download data from the open-source threat intelligence platform.
• Designing and implementing a task queue for the threat intelligence platform based on RabbitMQ, which is used to query for unhit data from the open-source threat intelligence platform.

NETWORK TRAFFIC MONITORING DESIGN
Designed a Bro-based network traffic monitoring tool that can monitor the IP quintet and domain access information of the platform. I also developed threat intelligence for querying public IPs and domain names to discover unknown risks. Monitored the intranet for malicious scans and other behaviors based on TCP flag statistics.

KUBERNETES SECURITY BASELINE DESIGN
I used Kube-bench and Kube-hunter to perform basic security scanning of Kubernetes to meet the security baseline requirements.

DOCKER IMAGE SECURITY SCANNING DESIGN
Used ClamAV and Clair to implement Docker's image scanning architecture, which can solve the risk of malicious files in the image and the use of vulnerable components.

OSQUERY-BASED HOST MONITORING
I designed osquery-based host monitoring rules and infrastructure to detect reverse shells and malicious processes.

I wrote a proxy tool that can be used to intercept HTTP requests. This tool automatically adds the payload to the HTTP request parameters. I used sqlmapapi.py, CasperJS, and my plugins to automate the scanning of the back-end API. My fuzz tool can help reduce the original manual testing time from eight hours to one hour.