Darlington Okeke
Cybersecurity Researcher | CEH | CPT | MSc Cyber Security | AI for Threat Detection
Cheltenham, United Kingdom
Actions
Darlington Chigozie Okeke is a cybersecurity researcher and practitioner specialising in human-centred security, artificial intelligence for cyber defence, malware analysis, and cyber threat resilience. His published research explores phishing vulnerability, cybersecurity awareness, and machine learning approaches to malware detection, bridging academic research with practical solutions for real-world security challenges. He holds an MSc in Cyber Security, as well as Certified Ethical Hacker (CEH) and Certified Penetration Tester (CPT) certifications, and is passionate about advancing cybersecurity through research, innovation, and community knowledge sharing.
Area of Expertise
Topics
Heuristic ML for Threat Detection in Microsoft Fabric
Modern security detection is no longer a tooling problem — it is a data engineering and analytics problem. Enterprise environments generate vast volumes of telemetry across endpoints, identities, networks, and applications, yet most organisations struggle to transform this data into actionable intelligence.
In this session, I present a highly technical, data-centric walkthrough of building a heuristic-based machine learning threat detection pipeline using the Microsoft Data Platform, based on my postgraduate research into ML-driven Trojan detection on Windows.
We will explore how raw security telemetry can be ingested, modelled, enriched, and analysed at scale using Microsoft Fabric, Azure analytics services, and SQL-based processing, before applying machine learning for behavioural detection.
Key technical areas covered include:
Designing a lakehouse-based architecture in Microsoft Fabric for security telemetry
Ingesting high-volume event data (process execution, API calls, entropy metrics, behavioural signals) into OneLake
Feature engineering using T-SQL, Spark SQL, and Dataflows to extract heuristic indicators such as execution patterns, import anomalies, entropy shifts, and behavioural sequences
Training and scoring ML models (XGBoost, Random Forest, ensemble classifiers) using Fabric notebooks and Azure ML integration
Persisting detection results back into structured tables for analytics and reporting
Visualising detection outcomes and trends using Power BI for analysts and decision-makers
The session focuses on how data professionals can design scalable, production-ready analytics pipelines that support advanced security use cases, demonstrating that modern threat detection is fundamentally an analytics and data modelling challenge.
Attendees will leave with practical architectural patterns and technical insight applicable to any organisation using Microsoft Fabric, Azure SQL, or Power BI to analyse large-scale operational or security data.
Practical AI for Developers: Real-Time Detection of Suspicious Code, Binaries, and API Behaviour
This lightning talk shows software engineers how AI and heuristic models can be embedded directly into development workflows to detect malware, suspicious binaries, and malicious behaviour before code ever reaches production. Based on my research building a heuristic machine-learning detection framework for Windows malware, I will demonstrate practical ways to integrate lightweight AI scanning into CI/CD pipelines, build scripts, and runtime environments.
We’ll explore three real engineering use cases:
AI-powered binary and dependency scanning inside CI workflows to detect obfuscation, malicious DLL imports, and Trojan-like patterns.
Runtime behavioural heuristics (API calls, entropy analysis, opcode signatures) that can be monitored using lightweight AI agents.
Practical integration with GitHub Actions, Azure DevOps, and container build pipelines to automatically flag suspicious artefacts.
This is a fast, hands-on, engineering-focused session designed to help developers add intelligent security checks into their build and release workflows using real, production-ready AI techniques.
AI-Powered Runtime Monitoring: Using Lightweight Heuristics to Detect Abnormal Behaviour in Product
Modern production systems generate massive volumes of telemetry, but most monitoring tools still rely on static thresholds and manual rules. This lightning talk demonstrates how lightweight AI heuristics can be used to detect abnormal runtime behaviour in applications and services without complex data science pipelines.
Using practical examples, I’ll show how simple ML models and heuristic signals—such as entropy shifts, API call frequency changes, and execution pattern anomalies—can be applied to runtime logs, process metrics, and telemetry streams to identify suspicious or malicious behaviour early.
The focus is on engineering-friendly implementation: how to deploy these techniques alongside existing monitoring stacks, trigger intelligent alerts, and reduce noise using AI-assisted signal scoring. This talk is aimed at software engineers looking to enhance observability and security using practical, production-ready AI techniques.
AI-Driven Heuristic Malware Detection for Windows: A Technical Guide for .NET & Cloud Developers
As attackers increasingly weaponize polymorphic, metamorphic, and obfuscated malware, traditional static and signature-based detection methods are no longer sufficient for developers building secure digital platforms—including Umbraco-based solutions. This session delivers a deep, developer-heavy technical walkthrough of a heuristic and machine-learning-driven malware detection framework engineered specifically for Windows environments.
Based on my postgraduate research, we’ll explore how to extract meaningful behavioral and structural indicators from Windows binaries using programmatic techniques such as entropy analysis, opcode pattern extraction, PE header inspection, DLL import analysis, API call sequence heuristics, and CFG profiling. We will then transform these indicators into feature vectors suitable for ML classifiers such as XGBoost, Random Forest, SVM, and ensemble models.
This session also demonstrates how to integrate this detection pipeline into modern .NET development workflows and Azure-based architectures, including:
automated feature extraction using Python/ML pipelines;
scoring malware samples in real time via Azure Machine Learning endpoints;
leveraging Event Tracing for Windows (ETW) to capture runtime behaviours;
feeding ML outputs into custom dashboards, security automations, or CI pipelines.
The talk includes a live demonstration of the detection engine analyzing real malware samples inside an isolated sandbox environment, showing developers exactly how heuristic patterns are generated, how ML models respond, and how detection results can be integrated into practical solutions.
Attendees will leave with a deep understanding of how to combine heuristics, behavioral analysis, and machine learning to build next-generation detection capabilities—knowledge directly applicable to building more secure applications, packages, and cloud workflows in the .NET and Umbraco ecosystems.
AI as a Security Engineer: Automating Threat Triage and Alert Prioritisation with Practical ML
Security alerts are noisy, repetitive, and time-consuming for engineering teams to triage. This lightning talk shows how small, focused AI models can be used to automate threat triage and prioritisation in real-world engineering environments.
Drawing from my work on heuristic-based malware detection, I’ll demonstrate how engineers can apply AI scoring to logs, alerts, and events to automatically classify severity, suppress false positives, and highlight genuinely suspicious behaviour. The talk focuses on simple, deployable techniques—feature scoring, rule + ML hybrid logic, and confidence thresholds—that fit naturally into engineering workflows.
This session is about AI doing useful work, not replacing engineers: reducing alert fatigue, speeding up response, and allowing teams to focus on what actually matters.
Advanced Threat Detection for Sitecore: Machine Learning Defense for Content Supply Chains
Sitecore’s transition toward XM Cloud, Headless Services, CDP, and Personalization APIs has introduced an entirely new attack surface—one that traditional AppSec tooling struggles to detect. Attackers now target headless content pipelines, JavaScript rendering hosts, personalization endpoints, GraphQL APIs, and Sitecore-managed microservices.
This session presents a highly technical deep dive into an AI-driven heuristic detection framework, adapted from my malware research, and engineered specifically to protect Sitecore cloud architectures running on Azure & Kubernetes.
We will explore:
1. Threat Landscape in Modern Sitecore Deployments
API scraping, credential stuffing, and token replay attacks on XM Cloud
Malicious bot traffic mimicking personalization behaviour
Exploiting Sitecore Experience Edge and CDP event pipelines
Attacks via JavaScript Rendering Hosts (Next.js / Vercel / Azure Front Door)
2. Why Traditional Detection Fails
Firewall & WAF evasion via user-agent rotation & behavioural masking
How attackers bypass CDN caching policies
Polymorphic API payloads that evade rule-based scanning
Adversarial ML attacks against behavioural analytics
3. AI/ML Heuristic Detection Framework for Sitecore
Adapting the ML methods used in detecting Trojan malware, this framework applies:
API call behavioural profiling (frequency, entropy, anomaly scoring)
Opcode-level analysis of serverless functions (Azure Functions)
Graph-based analysis of CDP event flows
Feature engineering from Sitecore logs, telemetry, Experience Edge events
XGBoost, SVM, Random Forest & Ensemble models trained to detect API abuse
Adversarial resilience techniques to prevent poisoning of ML models
4. Enterprise Architecture Blueprint
We will present a production-ready architecture showing:
Azure Sentinel + Defender for Cloud Apps integration
Real-time anomaly detection pipeline using Azure ML + Log Analytics
Automated blocking via APIM, Azure Front Door, and Sitecore Experience Edge
SIEM correlation rules tailored specifically for Sitecore workloads
5. Live Demo (Optional if accepted)
A safe, offline demonstration showing:
API-level attack simulation on a headless Sitecore endpoint
Detection of malicious behaviour via ML model
Automated mitigation triggers in Azure Front Door
A Taxonomy-Driven Detection and Mitigation Framework for Volumetric, Protocol, and Application-Layer
Cloud-native systems—from Azure Kubernetes Service to Sitecore XM Cloud’s headless architecture—are increasingly vulnerable to multi-vector DDoS attacks designed specifically to exploit resource elastic scaling, API gateways, microservices, and CDN-based delivery. Modern botnets now employ AI-based traffic shaping, rotating behavioral patterns, DNS water-torture attacks, HTTP/2 rapid reset attacks, and protocol abuse that bypass traditional rate limiting and WAFs.
This session provides a deep technical exploration of DDoS attacks in cloud environments, building upon the research taxonomy defined in DDoS Attacks in Cloud Computing: Issues, Taxonomy, and Future Research Directions, and extends it with new AI-driven detection patterns.
The session will cover:
1. Advanced Distributed Attacks in Cloud Computing
Volumetric floods (UDP amplification, SSDP/CLDAP, Memcached)
Protocol-level attacks (SYN/ACK floods, TCP exhaustion, HTTP/2 rapid reset)
Application-layer attacks (GraphQL/API flooding, slowloris variants, token exhaustion)
Botnet evolution: AI-driven request shaping and mimicked user behaviour
Attacks specifically targeting Autoscaling and Serverless consumption models
2. Cloud-Specific DDoS Issues
Exploitation of auto-scaling (cost exhaustion attacks)
API gateway crashes via malformed payload bursts
CDN caching bypass techniques
Microservice overload cascades
Saturation of headless rendering hosts (Next.js/Node servers in Sitecore XM Cloud)
“Stealth” L7 attacks that stay under WAF thresholds
Cloud-to-cloud bot propagation
3. Formal Taxonomy for Classification & Detection
Following the research paper taxonomy:
Attack vector classification (Volumetric, Protocol, Application)
Targeting classification (Infrastructure, Platform, Application)
Behavioural signature extraction
Botnet orchestration mapping
Resource consumption propagation models
4. AI-Enhanced Detection & Mitigation Pipeline
A full enterprise-ready architecture using:
Azure Front Door adaptive throttling
API Management anomaly detection
Azure Sentinel + UEBA for behavioural correlation
ML-trained anomaly detection using:
Flow-based features
Entropy of request headers
Inter-arrival timing patterns
Connection churn rate patterns
Time-series analysis using LSTM and Prophet models
Real-time traffic fingerprinting
Automatic IP reputation scoring using federated threat intel
Mitigation orchestration using Logic Apps and Azure Functions
Attendees will leave with a practical, cloud-centered, taxonomy-driven blueprint for building a resilient DDoS architecture in enterprise environments.
A Deep Technical Dive into Enterprise-Grade Windows Trojan Defense with Microsoft Defender XDR
Modern Windows environments—managed through Intune, Microsoft Defender XDR, Windows 365, and Azure—continue to face rapidly evolving Trojan malware that bypasses traditional static and dynamic detection. In this deep technical session, I present a heuristic-based machine learning detection framework developed through my postgraduate research, engineered specifically for Microsoft enterprise security stacks.
This session delivers a 300–400 level deep dive into how heuristic features (API call sequences, opcode patterns, entropy scoring, DLL imports, PE header anomalies, and behavioral telemetry from Windows internals) can be combined with ML models such as XGBoost, SVM, Random Forest, and ensemble classifiers to identify advanced Trojans—including polymorphic, metamorphic, and adversarial AI-generated variants.
We will walk through a production-ready architecture showing how these ML models can be integrated with:
Microsoft Defender for Endpoint (custom threat indicators, behavioural rules, ASR mappings)
Microsoft Sentinel (UEBA correlation, analytics rules enriched with ML anomaly scores)
Azure Machine Learning (model training, deployment pipelines, real-time inference)
Windows 11 / Windows Server (ETW-based telemetry collection and feature extraction)
The session includes a live demonstration of the detection pipeline running against real Windows samples inside an isolated VM, showing feature extraction, ML scoring, and automated alerting into Defender or Sentinel.
Attendees will gain a practical blueprint for deploying next-generation malware detection capabilities across hybrid and cloud-native workplaces, MSP-managed environments, and enterprise Microsoft security ecosystems. This session is grounded in real research, real experiments, and real-world implementation scenarios.
Modernising Malware Detection in Microsoft Ecosystems with AI-Driven Heuristics
Cybercriminals have weaponized metamorphic, polymorphic, and fileless malware to evade the entire traditional Microsoft ecosystem—from M365 endpoints to Azure Infrastructure-as-Code workloads. Static and dynamic detection alone are no longer sufficient for enterprise defense.
In this session, I present a heuristic-driven machine learning detection framework, originally developed through my academic research, used in live demonstrations, and delivered previously at industry events. The framework is specifically engineered to identify unknown and zero-day Trojan variants targeting Windows environments, leveraging Microsoft-aligned detection pipelines.
This deep-dive session will:
Deconstruct modern concealment techniques (packer evasion, obfuscation, anti-VM, anti-sandboxing, and adversarial ML poisoning).
Show why traditional AV, signature-based scanning, and sandbox environments fail against AI-generated Trojans (e.g., DeepLocker-style malware).
Demonstrate a full ML-powered heuristic architecture using realistic enterprise datasets (DLL imports, API call sequences, opcode n-grams, CFG flows, and hybrid feature engineering).
Compare the performance of XGBoost, SVM, Naïve Bayes, decision trees, random forest, and ensemble models under adversarial stress conditions.
Present a modular detection pipeline that can be integrated into Microsoft Sentinel, Defender for Endpoint, and Azure ML to enable real-time Trojan detection across enterprise systems.
Attendees will gain:
A production-ready detection blueprint tailored for Microsoft 365 and Azure workloads.
A deep understanding of how heuristic-based ML closes the gap left by static/dynamic techniques.
Insights into defending against adversarial attacks on ML models, a growing threat to enterprise AI systems.
Actionable architecture patterns that security engineers can deploy immediately in enterprise SOC environments.
Darlington Chigozie Okeke
PowerShell is not just a system administration tool — it’s also a powerful ally in cybersecurity. In this session, Darlington will demonstrate how PowerShell can be used to automate malware detection, streamline incident response, and strengthen Windows system defenses.
Building on his research into machine learning for Trojan detection, Darlington will show practical PowerShell techniques for security monitoring, log analysis, and rapid threat investigation. Attendees will gain insights into both real-world defensive use cases and forward-looking approaches where automation and AI converge.
Autonomous DDoS Defense in the Cloud: AI & Blockchain Approaches
As enterprises increasingly adopt hybrid and multi-cloud architectures, traditional perimeter-based defenses are proving inadequate against Distributed Denial-of-Service (DDoS) attacks, which exploit elastic scalability, multi-tenancy, and API-driven automation in cloud infrastructures. This session presents a highly technical exploration of both volumetric and low-rate, application-layer DDoS campaigns, detailing attack vectors such as SYN flooding, IP spoofing, smurf attacks, and adaptive slow-drip attacks, and exposing vulnerabilities across IaaS, PaaS, and SaaS layers.
We propose a multi-layered defense framework combining Machine Learning (ML), Blockchain, and Software-Defined Networking (SDN):
ML-Based Anomaly Detection: Real-time traffic classification using C4.5 decision trees, Convolutional Neural Networks, and Sparse Autoencoders, enabling autonomous adaptation to evolving attack signatures.
Blockchain-Enhanced Resilience: Decentralized trust and traffic validation via immutable ledgers and smart contracts, mitigating single points of failure in cloud ecosystems.
SDN and Zero-Trust Integration: Dynamic traffic rerouting, deep packet inspection, and least-privilege enforcement for scalable DDoS mitigation.
A key innovation, the Low-Rate DDoS Detection Algorithm (LRDADF), leverages deep convolutional networks and hybrid blockchain signaling to identify stealthy, coordinated slow-drip attacks that evade conventional detection.
Attendees will gain a research-driven roadmap for designing and implementing autonomous, blockchain-reinforced DDoS defenses, aligned with self-healing networks, distributed trust models, and AI-augmented cybersecurity paradigms. The session equips security professionals with a forward-looking blueprint to protect critical cloud assets in an environment where speed, scale, and sophistication define the threat landscape.
Autonomous DDoS Defense in the Cloud: AI & Blockchain Approaches
As enterprises increasingly adopt hybrid and multi-cloud architectures, traditional perimeter-based defenses are proving inadequate against Distributed Denial-of-Service (DDoS) attacks, which exploit elastic scalability, multi-tenancy, and API-driven automation in cloud infrastructures. This session presents a highly technical exploration of both volumetric and low-rate, application-layer DDoS campaigns, detailing attack vectors such as SYN flooding, IP spoofing, smurf attacks, and adaptive slow-drip attacks, and exposing vulnerabilities across IaaS, PaaS, and SaaS layers.
We propose a multi-layered defense framework combining Machine Learning (ML), Blockchain, and Software-Defined Networking (SDN):
ML-Based Anomaly Detection: Real-time traffic classification using C4.5 decision trees, Convolutional Neural Networks, and Sparse Autoencoders, enabling autonomous adaptation to evolving attack signatures.
Blockchain-Enhanced Resilience: Decentralized trust and traffic validation via immutable ledgers and smart contracts, mitigating single points of failure in cloud ecosystems.
SDN and Zero-Trust Integration: Dynamic traffic rerouting, deep packet inspection, and least-privilege enforcement for scalable DDoS mitigation.
A key innovation, the Low-Rate DDoS Detection Algorithm (LRDADF), leverages deep convolutional networks and hybrid blockchain signaling to identify stealthy, coordinated slow-drip attacks that evade conventional detection.
Attendees will gain a research-driven roadmap for designing and implementing autonomous, blockchain-reinforced DDoS defenses, aligned with self-healing networks, distributed trust models, and AI-augmented cybersecurity paradigms. The session equips security professionals with a forward-looking blueprint to protect critical cloud assets in an environment where speed, scale, and sophistication define the threat landscape.
AI Agents in Cybersecurity: Building Autonomous Threat Hunters with Azure AI
As cyber threats become more sophisticated, traditional security tools often fail to keep pace with evolving attack techniques. In this session, Darlington will explore how AI agents powered by Azure AI can be applied to cybersecurity — enabling autonomous detection, classification, and response to malware threats such as Trojans.
Drawing on his research in heuristic-based machine learning for malware detection, Darlington will demonstrate how agentic AI systems can bridge the gap between academic models and real-world applications. Attendees will learn practical ways to leverage tools like Azure AI Foundry and GitHub Copilot to build intelligent security workflows, integrate AI into defensive strategies, and move towards truly autonomous cyber defense.
Detecting the Undetectable: A Heuristic-Based ML Framework for Trojan Malware
This talk presents a machine learning framework for detecting Trojan malware on Windows systems, comparing static, dynamic, and heuristic-based detection techniques. Based on my master’s research, I explore how combining these approaches can significantly improve threat detection accuracy.
BSides Cheltenham 2025 Sessionize Event
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top