Neural Compile
Zhou Yuhang Education

SECURITY OPERATIONS · AGENTIC AI · PYTHON

ZHENGZHOU · 2026

Turning complex security problems into clear, executable engineering loops.

网络空间安全硕士在读，具备安全运营、Web 漏洞验证、告警研判与 Python 自动化实践经验；熟悉 LangGraph、LangChain、MCP、RAG 等 Agent 工作流及 FastAPI / Flask 后端开发，能够围绕安全业务落地自动化研判工具。另有数据采集、Hive 分布式存储与 WordPress 全栈开发项目经验。

  1. 01Security Operations & Offense/Defense
  2. 02Agentic AI Automation
  3. 03Python Engineering & Full-Stack
View Full Resume GitHub / sutaon
01

Education

From a data science undergraduate background to a master's in cyberspace security, I have built a knowledge structure that bridges data engineering and security technologies.

Zhengzhou University

Cyberspace Security · Full-time Master's Degree

  • GPA 3.85 / 5，平均成绩 84.70；连续两年获得郑州大学校级奖学金。
主修课程
  • 高级网络安全技术
  • 计算系统安全
  • 软件安全
  • 高级计算机网络
  • 网络安全
  • 3.85 / 5 GPA
  • 84.70 Average Score

Henan Polytechnic University

Data Science and Big Data Technology · Full-time Bachelor's Degree

  • 专业排名前 20%，GPA 3.34 / 5，平均成绩 83.35；获河南理工大学优秀学生通讯员、CET4。
主修课程
  • 数据结构
  • 数据库系统
  • 计算机网络
  • 操作系统
  • Linux 原理与应用
  • Java 程序设计
  • 数据爬取
  • 机器学习
  • 分布式数据库
  • Python 数据分析
  • 线性代数
  • 多元统计分析
  • 前 20% Major Rank
  • 3.34 / 5 GPA
  • 83.35 Average Score
02

Work Experience

Covers government security operations and data collection R&D, highlighting real responsibilities, handling processes, and verifiable results.

奇安信安全技术(南京)有限公司品牌标识
QIANXIN 安全实习生 · 安全服务 BG

Cybersecurity · Government & Enterprise Security Services

奇安信安全技术(南京)有限公司

  1. Asset Discovery
  2. Vulnerability Validation
  3. Alert Triage
  4. Closed-Loop Remediation
  • 安全技能实训系统学习资产指纹识别、端口 / 目录扫描、漏洞验证及报告编写与复测流程；熟练使用 Nmap、Nuclei 进行资产探测，通过 Burp Suite、sqlmap 验证 SQL 注入、XSS、文件上传、未授权访问及 RCE 等 Web 漏洞，结合 Wireshark 复核 HTTP / TCP 流量，并使用 Python / Shell 编写批量探测脚本及简易 PoC。
  • 驻场安全运营（豫信电科）依托“一道墙”及天眼平台，对 35 个统建政务系统开展告警值守，按业务 / 资产组筛选融合告警与多源关联告警，结合源 / 目的 IP、请求 / 响应体及访问链进行研判；发现并通报弱口令、SpringBoot 未授权访问、Swagger 敏感信息泄露等高危漏洞，跟踪修复闭环并提交攻击 IP 封禁；协助第三方公司对多个政府上线项目开展“两高一弱”账号和密码资源池排查及安全设备等保密评工作。
  • Quantified Impact累计监测恶意攻击告警 44,108 条（日均约 2,005 条，峰值 3,956 条 / 日），持续输出安全运行日报，维护 8 个项目 / 平台共 28 项安全问题记录，覆盖 11 类风险类型，有效保障政务资产安全。
  • 35 Government systems monitored
  • 44,108 Malicious alerts logged
  • 2,005/day Average daily alerts
  • 3,956 entries Daily peak
  • 28 items Security issues logged
Beijing Jianyu Information Technology Co., Ltd. Henan Branch logo
JIANYU 360 Crawler Development Engineer · Data R&D Department

Bidding Big Data · Collection R&D

Beijing Jianyu Information Technology Co., Ltd. Henan Branch

  1. Site Analysis
  2. Layered Collection
  3. Cleaning & Validation
  4. Reliable Delivery
  • 系统设计与采集开发主导招投标与政府采购信息采集系统开发与迭代，面向全国各级公共资源交易及政府采购站点，完成页面结构分析与动态加载机制识别，抽象统一的 XPath / CSS / 正则解析规则，实现核心字段结构化抽取与标准化映射；基于 Python 融合 Requests、BeautifulSoup 与 Selenium 实现动静态分层采集，落地多线程并发、分布式去重、智能重试、频率调控及全链路日志监控与入库校验流程。
  • 运营成果日均上线迭代爬虫任务 50+，采集成功率稳定在 96% 以上；通过架构与流程优化提升系统并发能力与运行稳定性，替代人工检索与录入模式，有效缩减人力成本。
  • 50+ Daily deployed/iterated tasks
  • 96%+ Data collection success rate
百度贴吧品牌标识
BAIDU TIEBA 垂类内容运营 · 校园组

社区内容运营 · 校园垂类

百度贴吧

  1. 内容巡检
  2. 社区协作
  3. 活动策划
  4. 数据复盘
  • 实习内容负责百度贴吧校园垂类内容运营，细分校园板块内容赛道；开展日常内容巡检，按规范处置违规信息，联动高校吧主维护社区秩序；策划校园主题活动，联动同类院校开展联名活动；挖掘推荐优质 UGC 内容，统计运营指标并输出周度复盘；协助开展吧主管理、规则宣导等事务。
  • 运营成果累计处置违规内容 100 余条；落地 2 场校园主题活动及院校联名活动，累计评论超 1,500 次，板块热度稳居同类院校前列，日均互动量提升 35%；挖掘推荐优质内容 10 余篇。
  • 100 余条 违规内容处置
  • 2 场 校园主题活动
  • 1,500+ 活动累计评论
  • 35% 日均互动提升
  • 10 余篇 优质内容推荐
03

Projects

6 个项目覆盖安全研判自动化、政务安全运营、全栈开发、分布式存储与数据分析。

01

Agentic SOC Assistant | AI-Powered Security Operations Automation

Lead

7Benchmark Investigation Scenarios
Project Overview Agentic SOC 智能告警研判系统（v0.3.0）面向政企与 SOC 安全运营场景打造，基于 LangGraph 构建 Agentic 告警研判工作流，将告警标准化、调查规划、受限工具调用、RAG 证据检索、风险判定、人工审批及报告生成串联为可测试、可追溯的状态化流程，同时提供 CLI、MCP stdio、FastAPI 与 Docker 等多形态运行入口。
Tech Stack 以 Python 3.11 / 3.12 为开发基础，核心采用 LangGraph、MCP 1.x、Pydantic v2、FastAPI 搭建研判服务内核，配套 Pytest、Ruff、Docker Compose、GitHub Actions 实现工程化测试与 CI 持续交付；预留本地 OpenAI-compatible 模型、Elasticsearch、OpenTelemetry 等扩展接口，支持检索、观测与推理能力的平滑升级。
Core Features 通过 MCP Server 开放资产查询、漏洞情报、已知漏洞检索、日志检索、SOP 检索五类只读安全工具，以 Schema 白名单、重试机制约束 Agent 调用行为，全程留存工具执行 ID 与脱敏查询指纹；实现 CISA KEV 公开情报安全同步与可审计离线快照管理，内置情报过期检测机制；设计 EvidenceGate 证据门禁，将研判结论与证据 ID 强绑定，通过多源日志关联、实体事件校验精准区分攻击确认、证据不足与误判场景，对高风险处置动作保留人工审批门槛，同时支持规则引擎与本地大模型双模式降级切换。
Project Outcomes 已覆盖 7 个基准研判场景，包含基础回归场景与真实公开情报典型路径；在基准测试集中，检索召回、工具调用、引用有效性、结论准确性及情报溯源等核心指标全部达标，无事实偏离问题；通过 45 项单元测试与多环境 CI 门禁验证，整套研判工作流实现可运行、可追溯、可评估与容器化部署。
  • 7Benchmark Investigation Scenarios
  • 45 项单元测试通过
  • 5 类只读安全工具
  • LangGraph
  • MCP
  • FastAPI
  • Pydantic
  • Docker
View on GitHub
02

Henan Province Digital Government "One Wall" Security Support Platform Alert Monitoring and Triage Project

Project Member

35Unified Government Systems
Project Overview Leveraging the Henan Province Digital Government "One Wall" security operations support platform, this project provides ongoing security operations for 35 unified government information systems on the government cloud, covering the full flow of traffic attack detection, defense validation, and alert triage, forming a closed loop of "monitor - triage - respond - remediate".
Tech Stack Integrates capabilities from QiAnXin Tianyan, SOC, NDR, WAF / IDS, and full-traffic situational awareness platforms, using multi-source alert correlation, full-traffic replay, exploit chain analysis, attack success validation, protocol behavior analysis, false positive attribution, and whitelist strategies to build attack evidence chains.
Core Features Covers attack scenarios including vulnerability scanning, weak password brute force, unauthorized access, web injection, command execution, WebShell communication, and abnormal outbound connections; distinguishes real attacks, vulnerability exposure, blocked attacks, platform false positives, scanner simulation traffic, and normal business access, outputting standardized handling recommendations.
Project Outcomes On average, monitors and handles about 2,005 malicious attack alerts daily, reducing false positives/negatives and manual review costs, shortening risk response time and vulnerability exposure windows, and ensuring zero major security incidents during major provincial platform events.
  • 35Unified Government Systems
  • 2,005/day告警监测处置
  • 0重大安全事故
  • SkyEye
  • SOC
  • NDR
  • WAF / IDS
  • Full Traffic Retrospection
03

Traffic Attack Alert Auto-Triage Skill

Creator

90%+Triage Accuracy
Project Overview 面向政务服务平台及政企安全运营中心，设计适配一道墙、天眼、SOC / WAF / NDR 等多类安全平台的流量攻击告警智能研判 Skill，将零散孤立的告警转化为覆盖攻击意图识别、漏洞可利用性评估、成功证据验证、业务合法性检查、影响定级、通报决策的结构化研判流程，辅助一线安全人员高效开展高频告警初筛与复核工作。
Tech Stack 基于 Codex Skill 框架进行开发，采用 Python、JSON、Markdown / YAML 实现研判规则与逻辑编排；融合 HTTP / WAF 日志分析、应用与数据库审计、EDR 主机日志、OOB 回连验证等技术手段，对接 CISA KEV、FIRST EPSS、NVD CVE API 实时漏洞情报，依托 GitHub Actions 实现工程化迭代与能力落地。
Core Features 搭建四级攻击判定体系，结合请求响应、多源日志、资产暴露面、历史处置记录等维度形成完整证据链，全面覆盖弱口令、未授权访问、注入攻击、WebShell、组件暴露及扫描器仿真流量等攻击场景；接入实时漏洞情报评估处置优先级，严格区分通用漏洞评级与本地实际利用结果，自动输出分类研判结论及配套证据、处置口径与修复建议。
Project Outcomes 经脱敏历史告警样本回放验证，辅助研判准确率达 90% 以上，可稳定区分攻击成功、误报、扫描探测等多类场景；落地政企告警初筛场景后统一通报标准，有效降低孤立字段判定导致的误通报，同时优化扫描器告警处置逻辑，精准识别资产暴露风险；经高危漏洞场景演练可实现攻击结果精确分级，支持重复告警聚合提升复盘效率；核心 Skill 体量缩减 56% 并拆分为按需加载模块，触发效率与可扩展性显著提升。
  • 90%+Triage Accuracy
  • 56%核心体量缩减
  • Codex Skill
  • Python
  • CISA KEV
  • EPSS
  • WAF / NDR
View on GitHub
04

Design of a Distributed Storage Platform for a Hive-Based Tobacco Control System

Core Developer

1 Master, 2 SlavesHadoop Cluster
实际用途 A thesis prototype for tobacco retail registration and regulatory oversight: retail staff upload cigarette box QR code images for product registration and query their own scan details by account; administrators view global records, tobacco type and date statistics, and manage users, providing a unified entry point for product flow registration and regulatory analysis.
Technical Implementation Set up a Hadoop 2.9.2 cluster with one master and two slaves in VMware, using HDFS dual replication, Hive 3.1.2, and MySQL Metastore; the HTML/JavaScript frontend calls Python via Apache/PHP, using OpenCV for QR code parsing and SHA-256 to verify duplicate records, writing id, code, hash, date, and user fields to CSV, then uploading to HDFS and loading into Hive user tables via PyHive and LOAD DATA.
Data Pipeline Implements a closed loop of "image upload - QR code decoding - registration confirmation - hash deduplication - HDFS distributed storage - Hive query and statistics," along with login/registration, personal detail queries, statistical analysis, user management, and three-node status display.
Project Highlights Delivered an end-to-end prototype from QR code registration to regulatory query, using digest validation to block duplicate scans and organizing HDFS files and Hive tables by user to demonstrate data consistency, queryability, and traceability. The public demo runs in a browser simulation and does not connect to real Hadoop/Hive services.
  • 1 Master, 2 SlavesHadoop Cluster
  • SHA-256重复记录校验
  • Hadoop
  • HDFS
  • Hive
  • Python
  • PHP
View Project Demo
05

Personal Blog Development & Polish

Core Developer

Project Overview Independently built a WordPress-based personal blog and membership social platform, developing a custom responsive theme and membership business plugins. Integrated content creation, membership tiers, social interactions, and project showcase modules, with a three-level permission system, deployed on Alibaba Cloud Linux servers.
Tech Stack Extended business capabilities with WordPress and PHP, designing custom business tables on MariaDB with optimized indexes; used vanilla JavaScript for seamless interactions and responsive layouts, and handled server deployment, security hardening, and automated testing.
Core Features Implemented content creation, member registration/login, profile and privacy management, friend and direct messaging, comments and likes, and project demos, with tiered permissions for public visitors, regular members, and admins.
Project Outcomes Completed the full cycle from theme development to public deployment, evolving a single blog into an integrated content and social platform; optimized data models for concurrency consistency and built an automated testing framework to support continuous iteration.
  • WordPress
  • PHP
  • MariaDB
  • JavaScript
  • Apache
Visit Live Site
06

Student Grade Prediction & Analysis System

Core Developer

6 CategoriesData Processing Steps
Project Overview Using Python, pandas, scikit-learn, Matplotlib, Seaborn, and an HTML frontend, completed the full pipeline including data cleaning, missing value imputation, consistency checks, one-hot encoding, feature engineering, and visual exploration.
Results Built three models—random forest, linear regression, and SVM—with cross-validation for model selection and serialization; the system supports real-time feature input and displays predictions along with multi-dimensional visual reports.
  • 6 CategoriesData Processing Steps
  • pandas
  • scikit-learn
  • SVM
  • Visualizations
04

Extracurricular Experience

Campus organizations, community moderation, and team training that strengthen collaboration, communication, and project execution skills.

郑州大学 · 信安 3-6 班计算机网络实验课

助教

任本科《计算机网络》实验代课助教，带教 11 个实验：用 Wireshark 完成 IP / TCP / UDP / HTTP 等协议抓包分析，用 Packet Tracer 指导 VLAN 与静态、RIP / OSPF 路由配置，辅导 Socket 编程，负责答疑与报告批改。

Henan Polytechnic University · Big Data Class 2002

Class Organization Committee Member

Planned, followed up on, and executed full-cycle class and college activities; managed party fee collection and Youth Learning session scheduling for the class party branch; organized safety awareness talks and emergency drills to boost team cohesion.

Computer Youth Association

External Relations Officer

Coordinated campus volunteer and maintenance events such as computer repair and cleaning and winter clothing donations, handling staffing and workflow; participated in volunteer activity planning competitions and filmed college major documentaries.

Neusoft Corporation · Data Analysis and Machine Learning Training

Team Lead

Led a 6-member team to develop a student grade prediction system end-to-end, coordinating task allocation and project progress. Used pandas for data cleaning and feature engineering, built random forest, linear regression, and SVM models with scikit-learn, and completed model selection and serialization via cross-validation; implemented front-end feature input, real-time prediction, and multi-dimensional visual reports, and led the final defense and demo.

  • 6 members R&D team
  • 3 models Model selection completed
05

荣誉证书

英语能力与在校荣誉。

CET4

CET-4

HONOR
郑州大学校级奖学金

2024 年 12 月

HONOR
郑州大学校级奖学金

2025 年 12 月

HONOR
河南理工大学优秀通讯员

2022 年 6 月

HONOR
06

Skills

围绕安全运营、AI Agent 与后端开发，贯通漏洞验证、证据研判、数据处理和工程交付。

  1. 01

    网络安全运营与渗透验证

    • Nmap
    • Nuclei
    • Burp Suite
    • sqlmap
    • Wireshark
    • OWASP Top 10
    • SOC / WAF / NDR
    资产识别与漏洞验证
    熟悉资产指纹识别、端口 / 目录扫描与攻击面梳理，能够使用 Nmap、Nuclei 开展资产探测，结合 Burp Suite、sqlmap 验证 SQL 注入、XSS、文件上传、未授权访问、弱口令及 RCE 等常见 Web 风险，整理复现步骤、影响范围与修复建议。
    流量分析与证据核查
    能够使用 Wireshark 分析 HTTP / TCP 流量，关联源 / 目的 IP、XFF、请求载荷、响应内容、状态码与前后访问记录，结合资产和业务上下文还原攻击链；区分漏洞暴露、攻击尝试、已阻断攻击、攻击成功及正常业务误报。
    安全运营与整改闭环
    熟悉一道墙、天眼及 SOC / WAF / NDR 平台的告警筛选和多源关联，能够按业务与资产组开展风险分级、问题通报、封禁申请与白名单建议，跟踪整改复测，维护安全问题台账并输出运行日报与复盘记录。
    自动化脚本与规则沉淀
    能够使用 Python / Shell 编写批量探测、日志字段提取和简易 PoC 脚本，将重复告警归并、样本核查与处置经验整理为可复用的研判规则和 SOP，支持高频告警初筛与人工复核。
    实践：Web 漏洞验证、35 个政务系统值守、44,108 条告警监测与问题闭环
  2. 02

    AI Agent 与安全自动化

    • LangGraph
    • LangChain
    • MCP
    • RAG
    • EvidenceGate
    • CISA KEV / EPSS
    • Python
    Agent 工作流编排
    熟悉 LangGraph / LangChain，能够围绕告警标准化、调查规划、工具调用、检索取证、风险判定与报告生成设计状态化流程，通过条件分支、重试与规则降级处理证据不足或模型不可用的情况。
    MCP 与受限工具调用
    掌握 MCP Server 工具接入及 Pydantic / JSON Schema 数据校验，能够定义只读工具、输入白名单与结构化返回值，留存执行 ID 和脱敏查询指纹，使资产、日志、漏洞与 SOP 查询可审计、可追溯。
    RAG 与漏洞情报融合
    能够结合 RAG 检索、多源日志与 CISA KEV、FIRST EPSS、NVD CVE 情报组织研判证据，关注情报来源、快照与时效性；使用 EvidenceGate 将结论绑定证据 ID，区分通用漏洞风险与本地实际利用结果，减少无依据推断。
    评估与安全边界
    具备 Codex Skill 规则编排、按需加载模块与结构化报告设计经验，能够通过脱敏样本回放、基准场景和自动化测试检查工具调用、引用有效性与结论准确性，并为高风险处置保留人工审批。
    实践：Agentic SOC Assistant、流量攻击告警研判 Skill、7 个基准场景与 45 项测试
  3. 03

    后端开发与数据工程

    • Python
    • FastAPI / Flask
    • MySQL / MariaDB
    • Hadoop / Hive
    • pandas
    • scikit-learn
    • WordPress / PHP
    • Linux
    • Docker
    • CI / CD
    Python 服务与数据采集
    熟练使用 Python，熟悉 FastAPI / Flask 接口开发与 Pydantic 数据校验；能够结合 Requests、BeautifulSoup、Selenium 完成动静态分层采集，使用 XPath / CSS / 正则抽取字段，配套并发处理、去重、异常重试、频率调控、日志与入库校验。
    数据库与分布式存储
    熟悉 MySQL / MariaDB 表结构设计、SQL 查询、索引与事务，能够围绕业务组织结构化数据；了解 Hadoop 架构，具备 HDFS、Hive、MySQL Metastore 与 PyHive 的原型实践，可串联数据校验、分布式存储、入仓及统计查询流程。
    数据建模与可视化
    熟练使用 pandas 进行缺失值处理、一致性校验、独热编码与特征工程，使用 scikit-learn 构建随机森林、线性回归、SVM 模型并通过交叉验证选型；结合 Matplotlib、Seaborn 展示探索结果，完成模型序列化与预测接口集成。
    全栈交付与工程维护
    熟悉 PHP、WordPress 主题与插件开发、原生 JavaScript 交互及分层权限设计；掌握 Linux、Apache、Docker 与 Git，能够使用 Pytest、Ruff、GitHub Actions 建立测试和 CI 检查，完成服务部署、配置管理、日志排查与持续迭代。
    实践：日均 50+ 采集任务、Hive 烟草管控原型、WordPress 全栈平台与成绩预测系统
07

Self-Assessment

A brief overview of work style, learning status, and personal interests.

具备网络安全、后端开发与数据建模的复合技术能力，擅长安全自动化工具与 AI Agent 工作流的落地实现，做事严谨细致，秉持闭环思维，能快速学习新技术并结合业务场景落地应用，具备良好的团队协作与执行力。日常热爱羽毛球、慢跑与音乐，坚持规律运动，习惯在运动中梳理思路、调节状态，始终以沉稳积极的态度应对工作与生活。
GitHub / sutaon