Abdallah Abughallous AbdaullahAG

🛡️ `whoami`

🎓 Computer Networks & Cybersecurity Graduate | WISE University
💻 Former Trainee @ Jordan National Cyber Security Center (NCSC) — Masar Program (30+ labs across Red/Blue/GRC + capstone project)
🧑‍💻 Section Lead & Co-Author — OWASP GenAI Security Project, Agentic Identity Maturity Model (AIMM)
🛡️ Author of SemGuard — multilingual LLM security gateway, published & indexed in IEEE Xplore (IEEE AEECT 2026) — plus 2 further preprints on LLM security (see Publications below)
📊 Creator of the 1st Arabic LLM Security Dataset — featured in
🔎 Creator of ThreatLens — a threat-intel & CVE-triage CLI (CISA KEV + EPSS decision engine, SIEM export), officially featured in the community's list
🧪 Merged contributor to Microsoft PyRIT — added the SemGuard Arabic Security Dataset loader to Microsoft's GenAI red-teaming framework (4.5K★)
🔭 Focus: LLM & AI Security · Adversarial ML · Pentesting · SOC Analysis
🌐 Active Open-Source Contributor | OWASP FIASSE (SSEM code examples) & OWASP CVE Lite CLI (CycloneDX SBOM output) & Microsoft PyRIT (dataset loader) & Global Awesome Lists (Awesome OSINT, Awesome AI Security)

🤖 AI & LLM Security — Featured Work

Project	Stack	What it does
🛡️ SemGuard	`LLM Security` `Multilingual`	Triple-Anchor semantic security gateway guarding LLMs against prompt-injection & semantic attacks across Arabic, Arabizi & English — 0.989 F1 · 0.991 Recall on Arabic prompt-injection detection, validated on an 807-sample Arabic LLM Security Dataset (Fleiss' κ = 0.839). 📊 Dataset on HuggingFace
🥷 Autonomous AI Red/Blue Lab	`Azure AI Foundry` `Multi-Agent` `OWASP AIMM`	Closed-loop multi-agent pipeline — real exploitation + self-healing patching, SPIFFE-style agent identity, enforced per-agent scope, SHA-256 hash-chained audit log. 70% patch-validation success, 100% chain integrity over 10 real runs.
🧮 tawfeer-llm (ar-tokenwise)	`Python` `PyPI Package`	Published package that conservatively normalizes Arabic text for LLM pipelines and reports measured (not estimated) token/cost savings against real tokenizer & provider APIs; benchmarked on FLORES-200 & TyDiQA-GoldP, with RAG-aware chunking and dialect-signal detection.
🔐 TrustGuard AI	`Multi-Agent` `Flask`	6-agent reasoning pipeline auditing Privacy Policies/ToS vs. TikTok, Meta, WhatsApp

📄 Publications

SemGuard: A Triple-Anchor Semantic Security Gateway for Multilingual Prompt Attack Detection in Large Language Models

📍 Published & indexed in IEEE Xplore — 2026 IEEE Jordan Conference on Applied Electrical Engineering and Computing Technologies (AEECT) 👤 Abdallah M. Abughallous, Dr. Somia Abufakher 🔗 DOI: 10.1109/AEECT69724.2026.11657880 🔑 Proposed the first Triple-Anchor Semantic Threat Modeling framework for multilingual LLM security, built on the first Arabic prompt-attack dataset validated by three independent LLM judges.

LLM Security Prompt Injection AI Security Arabic NLP Explainable AI

Impersonation Ambiguity as a Security Signal: A Quantitative Framework for Role-Play vs. Malicious Impersonation Detection in LLMs

📍 Preprint — Zenodo 👤 Abdallah M. Abughallous 🔗 DOI: 10.5281/zenodo.22302105 🔑 Introduced the Impersonation Ambiguity Index (IAI), scoring inputs across four independent axes to turn high LLM-judge disagreement into a usable security signal rather than annotation noise.

LLM Security Impersonation Detection Role-Play Safety LLM-as-a-Judge

Traceable Autonomy: Identity, Scope Enforcement, and Containment in a Closed-Loop Red/Blue Agent Pipeline

📍 Preprint — Zenodo 👤 Abdallah M. Abughallous 🔗 DOI: 10.5281/zenodo.22847266 🔑 First non-simulated operationalization of OWASP AIMM's Traceability pillar — SPIFFE-style agent identity, enforced per-agent scope, and a hash-chained audit log across a real closed-loop agent pipeline. Surfaced an emergent finding: automated patching that silently broke legitimate app functionality, motivating a post-patch Attestation-style validation gate.

Agentic AI Security AIMM Traceability Scoped Delegation Autonomous Red Teaming SPIFFE

⚔️ Offensive / Defensive Security Projects

Project	Stack	Highlight
🐝 OWASP FIASSE	`Python` `OWASP` `SSEM`	Contributed Python security code examples showcasing SSEM attributes — merged into `main`
📦 OWASP CVE Lite CLI	`TypeScript` `OWASP` `SBOM`	Bumped the default CycloneDX SBOM output from 1.4 to 1.6, validated against the official schema — merged into `main`
🧠 Microsoft PyRIT	`Python` `GenAI Red-Teaming`	Added the SemGuard Arabic Security Dataset loader (807 examples) to Microsoft's GenAI red-teaming framework (4.5K★, 892 forks) — merged after multiple rounds of maintainer review, landing with 14 passing unit tests
🔎 ThreatLens	`Python` `Vulnerability Triage` `SIEM`	Threat-intel CLI unifying 8 OSINT/vuln feeds (incl. CISA KEV + EPSS); generates auditable Patch/Isolate/Monitor decision cards, exports to Splunk/Elastic/Sentinel, produces SHA-256 chain-of-custody evidence packs — 155 passing tests + CI
🧬 Red/Blue Team Lab (NCSC Capstone)	`Flask` `Splunk` `Kali Linux`	Exploited & patched SQLi/XSS/Cmd-Injection on a 3-VM lab + Splunk HEC detections
📡 NIDS/NIPS	`Snort 3`	Custom rules detecting & blocking live attack traffic
🌐 Enterprise Network (CCNA)	`OSPF` `VLANs` `Packet Tracer`	Smart Campus graduation project — enterprise routing & switching security
🛣️ Rased	`YOLOv11` `TFLite`	Road-defect computer-vision detector — Crown Prince Award entry