Public // Portfolio // Ref WI-2026-01 ◆ Open to a 6-month internship from March 2027 · France ◆ SecureIT CTF 2025 · 2nd Africa & Middle East ◆ IDS macro-F1 0.7711 on 15 classes ◆ EcoRoute · −69.7% LLM cost ◆ Intigriti · dilawishere ◆
Analyst
Walid Ichchou
Discipline
Security · Cloud · AI
Based in
Clermont-Ferrand, FR
Status
Available Mar 2027

WalidIchchou

// pentest · bug bounty · deep learning for detection · cloud

I break web apps and APIs, then train the models that catch the next attack. Engineering student in cybersecurity and cloud at ENSAM Casablanca, now in a double degree in machine learning and decision science at ISIMA. Bug bounty hunter on Intigriti.

Email me Open the AI lab Case files CV (PDF, FR) GitHub ↗
tty1 · walid@ichchoutype help
walid@ichchou:~$ whoami walid ichchou, security engineer who trains models walid@ichchou:~$ cat focus.txt offense web & API pentest (PTES, OWASP), bug bounty defense deep-learning intrusion detection, SIEM + ML pipelines ai PyTorch, attention models, LLM routing, imbalance handling platform AWS serverless, Docker, Kafka, Spark, Linux try: models · projects · intigriti · ctf · sudo hire walid
§1

Summary of findings

2nd

Africa & Middle East, SecureIT CTF by Cisco Networking Academy (2025)

16.2M

network flows behind the intrusion detection model I trained

0.77

macro-F1 across 15 traffic classes on CSE-CIC-IDS2018

69.7%

LLM cost cut by EcoRoute vs always calling GPT-4o, within 0.3 points of accuracy

Assessment

The subject works on both sides of the wire and brings machine learning to each. Offense: PTES and OWASP audits of web applications and APIs, automation in Python and Nuclei, bug bounty research on Intigriti. Defense: a deep-learning intrusion detection platform, ML scoring of SIEM alerts in AWS Lambda, and an LLM gateway that keeps confidential data away from models not cleared for it.

Recommendation: suitable for AI security, detection engineering, cloud security and DevSecOps roles. Comfortable writing the report, not only finding the bug.

§2

AI lab

Machine learning applied to security problems. Each model is written up as a model card: what it does, what it was trained on, how it scored, and where it falls short.

Most of my ML work starts from a security question. Which flow is an attack? Which alert deserves a human? Which LLM is allowed to see this prompt? I care as much about class imbalance, calibration and honest evaluation as about the architecture.

  • Deep learning CNN · BiLSTM · attention
  • Imbalance logit adjustment · focal loss
  • Routing graph model · calibration
  • Unsupervised clustering · anomalies
  • Coursework ML & data mining · HPC
Model card · MC-01 · PyTorchDeep learning

Flow classifier for IDS

CNN-BiLSTM + multi-head attention pooling · ~0.98M parameters
Task
Label every network flow as benign or one of 14 attack families, with severity and confidence.
Data
CSE-CIC-IDS2018: 16.2M flows, 47 features each, about 16 GB of CICFlowMeter CSVs.
Results
Macro-F1 0.7711 over 15 classes, accuracy 91.6%, benign recall 98.6% on 212,330 held-out flows.
Limits
Infiltration overlaps benign traffic in feature space. The three web-attack classes have only a few hundred samples.
What I learnedStacking oversampling, weighted sampling and class weights gave the model a uniform prior and collapsed benign recall to 0.29. Logit adjustment plus focal loss fixed it, and adding the class prior back at inference lifts macro-F1 from 0.64 to 0.77.
  1. Input flow47 features → reshaped to T=12 × C=4
  2. Conv1d ×2 + GELUkernel 3, local feature patterns
  3. BiLSTM ×2hidden 128, both directions
  4. Attention pooling4 heads
  5. MLP head13 classes
  6. LR splitterrestores 3 web-attack classes → 15
  7. Alertlabel · severity · confidence → hashed to ledger
Model card · MC-02 · PythonLLM security

EcoRoute router

Weighted decision graph · calibrated P(correct) per model
Task
Send each LLM request to the cheapest model likely to answer it correctly, but only among models cleared for the data's sensitivity level.
Method
A graph links each prompt to skills, a difficulty level and its 32 most similar past prompts. A PII model plus caller labels set the sensitivity level first.
Data
SPROUT prompts and BigCodeBench coding tasks. Tested on 4,295 held-out prompts.
Limits
Predicting which model solves a coding task is the weak spot (AUC 0.65). Research prototype, not run in production.
Median decision
74 ms
p95
121 ms
E2E checks
16/16
ML · cloud · 2025

Alert scoring in AWS Lambda

Wazuh alerts are enriched and scored by a model inside Lambda functions, so analysts see the riskiest ones first.

Unsupervised · 2025

Anomalies in network logs

Clustering methods compared on how well they separate truly unusual behaviour from false positives.

ISIMA · 2026–27

ML & decision science

Machine learning and data mining, decision under uncertainty, optimization and HPC, taught in English.

§3

Case files

Projects, with the numbers that back them up.

CF-01 · 2026 · Team of 41st place, ENSAM project competition

IDS-Blockchain

Real-time network intrusion detection. The flow classifier from the AI lab scores live traffic, and high-severity alerts are hashed into a private MultiChain ledger, so the alert history cannot be quietly rewritten.

My part: preprocessing, model training, evaluation and the inference API.

Flows
16.2M
Macro-F1
0.7711
Accuracy
91.6%
Benign recall
98.6%
  • PyTorch
  • Spark
  • Kafka (KRaft)
  • MultiChain
  • Streamlit
  • Docker Compose
Repository ↗
traffic  CICFlowMeter CSVs · 16 GB
   │
   ▼
spark    distributed preprocessing
   │
   ▼
model    Conv1d ×2 → BiLSTM ×2 → attention
   │      label + severity + confidence
   ▼
ledger   SHA-256 chained alert blocks
   │
   ▼
console  Streamlit · Kafka · Structured Streaming

services decoupled by Kafka; persistent
volumes; degrades gracefully if one dies
CF-02 · 2026AI · research prototype

EcoRoute

An LLM gateway that routes each request by predicted answer quality, cost and data sensitivity. Confidential prompts never reach a model without the clearance for them.

Cost saved
69.7%
Accuracy Δ
−0.27 pt
Decision
74 ms
  • Python
  • PyTorch
  • Graph model
  • PII detection
  • OpenAI-compatible API
Repository ↗
CF-03 · 2025Cloud · ML

Serverless SIEM + ML on AWS

Wazuh alerts are ingested, enriched and scored by a model inside AWS Lambda functions, then stored on S3. A Streamlit console runs on an EC2 instance I provisioned and configured.

  • Wazuh
  • AWS Lambda
  • S3
  • EC2
  • Scikit-learn
CF-04 · 2025Network

Stateful firewall in Python

An inline component that tracks connection state, applies configurable rules, and writes structured logs for every decision.

  • Python
  • Connection tracking
  • Structured logging
CF-05 · 2025ML · detection

Anomaly detection on network logs

A comparison of clustering methods to separate behaviour that is truly unusual from false positives.

  • Scikit-learn
  • Pandas
  • Clustering
§4

Engagements

Work, research and training, most recent first.

  1. 2026 →
    Active

    Bug bounty research

    Independent researcher · Intigriti · dilawishere ↗
    • Programs: DHL, Monzo, Spacelift. Recon and mapping of exposed infrastructure.
    • First validated vulnerability: details withheld under disclosure policy
    Remote
  2. Jun → Jul 2025

    Web & API pentest internship

    Plutus Solutions
    • Security audits of web applications and APIs following PTES and the OWASP methodology.
    • Automated verification in Python and Nuclei.
    • Structured reports with risk, evidence and remediation, written for the development teams.
    Mohammedia, MA
  3. 2026 → 2027

    MSc Computer Science, ICS track

    ISIMA · Clermont Auvergne INP · double degree
    • Decision under uncertainty, machine learning & data mining, optimization, HPC. Taught in English.
    Clermont-Ferrand, FR
  4. 2022 → 2027

    Engineering degree, Cybersecurity & Cloud

    ENSAM Casablanca · Université Hassan II
    • Cloud, DevOps, systems architecture, network and application security.
    Casablanca, MA
§5

Recognition

Competitions and certifications.

ResultEvent or certificationDate
1stProject competition, ENSAM Casablanca, for the AI intrusion detection platform2026
2ndSecureIT CTF, Africa & Middle East, Cisco Networking Academy2025
CertFortiSASE & SD-WAN 7.6 Core Administrator, FortinetApr 2026
CertCyber Security 101, TryHackMeJun 2025
CertPython Programming with Red Hat (AD141), Red HatMay 2025
§6

Toolkit

What I have used on real work, grouped by where it sits in the stack.

Offensive

  • Burp Suite web · API
  • Nuclei automation
  • Nmap recon
  • OWASP Top 10, PTES method

AI & ML

  • PyTorch CNN · LSTM · attention
  • Scikit-learn clustering · baselines
  • TensorFlow coursework
  • Hugging Face PII model
  • Pandas analysis

Detection

  • Wazuh SIEM
  • Log collection & alerting ops
  • Anomaly detection ML
  • Streamlit dashboards viz

Data

  • Spark batch · streaming
  • Kafka (KRaft) events
  • SQL daily

Cloud & platform

  • AWS Lambda, S3, EC2 deployed
  • Docker, Compose daily
  • Proxmox, Linux lab · admin
  • Azure learning

Network

  • FortiSASE & SD-WAN certified
  • Stateful filtering built
  • Python, Bash, Git daily
§7

Field notes

Writeups and lessons learned. First entries are in progress.

  1. CTFSecureIT CTF 2025: how we placed 2ndChallenge-by-challenge writeup of the regional final.Draft
  2. ML · IDSWhy stacking oversampling broke my IDSBenign recall fell to 0.29. Logit adjustment fixed it.Draft
  3. AI securityKeeping confidential prompts away from the wrong LLMHow EcoRoute enforces clearance before it optimizes cost.Draft
  4. Bug bountyRecon notes from my first validated findingMethodology only, published once disclosure allows it.Draft
§8Contact

Looking for a 6-month internship from March 2027.

Security, cloud, DevOps or AI. Anywhere in France. Write in French or English.