Research
Academic work and conference talks on intrusion detection, machine learning, DevSecOps, and cloud security.
Theses
Natural Language Processing with Machine Learning for Anomaly Detection on System Call Logs
Christo Goosen · Supervisor: Prof. Karen Bradshaw
Applies natural language processing with supervised and unsupervised machine learning to raw, unstructured x86_64 GNU Linux system call traces to detect current and previously unseen threats. Random Forest is compared against Isolation Forest, with and without hyper-parameter tuning, on the Leipzig Intrusion Detection Data Set (LID-DS) combined with executed malware samples from the VirusTotal Academic dataset. Isolation Forest paired with Principal Component Analysis proved effective at identifying anomalies once tuned.
A Hybrid Taxonomy & Model for Detecting Source Code Authorship Misconduct: Classifying Code Duplication as Self-Plagiarism
Christo Goosen · Supervisor: Mr RJ Barnett
Proposes a single hybrid taxonomy and modular model for classifying and detecting both plagiarism and code duplication in software source code, treating duplication as a form of self-plagiarism. The combined taxonomy improved classification of the two related phenomena, added classifications describing the behaviour applied by the author, and showed that a system applying the model could detect and distinguish the type of misconduct.
Talks & Videos
BSides Joburg 2026
Turning Roadkill into braAI-VibeSDLC
BSides Cape Town 2019
Natural Language Processing & Anomaly Detection in Sys Call Logs
BSides Cape Town 2018
Lightning Talk: Anomaly Detection in Container Sandboxing
BSides Cape Town
TODO: “Secure(r) Cloud Development” (with Toufeeq Ockards)
DevOps Cape Town
Google gVisor Container Runtime Sandbox
AI Security Engineers Community
DevSecOps: The City of Troy & Securing from Within
CAST
DevSecOps
PyCon South Africa
Sanic: Async Python (uvloop) with a Familiar Flask-like Feel
Python tutorials by AR
MicroPython: Python for Microcontrollers and Constrained Environments
Press & Mentions
BSides Joburg: Turning Roadkill into braAI-VibeSDLC
Christo talks about his role as a DevSecOps Lead and the challenge of helping developers build securely in a world of AI-assisted development, and leads a talk on AI and supply chain security.
Speaker Announcement: Turning Roadkill into braAI-VibeSDLC
BSides Joburg announces Christo's talk on rolling out Claude Code Enterprise securely to 200+ engineers over 3–6 months, and turning agentic roadkill into a product with an AI-SDLC.
Christo Goosen: Solving Security Challenges
Speaker profile and interview covering Christo's path from software development into security, his work with the OWASP South Africa community, and his panel at the ITWeb Security Summit 2016.