SEIS 666 -- Class Project Submission¶

Track A: Knowledge Graph + AI System

University of St. Thomas | Spring 2026 | Instructor: Daniel Yarmoluk

Project¶

Nexus SecOps -- The Definitive Cybersecurity Operations Encyclopedia

Domain Rationale¶

Cybersecurity operations is a domain with deep, interconnected concepts where prerequisite ordering is critical. You cannot learn Detection Engineering without first understanding SIEM fundamentals, log sources, and TTPs. You cannot perform Threat Hunting without first mastering Detection Engineering, Threat Intelligence, and data analysis.

This makes cybersecurity a perfect domain for knowledge graphs. The 448 concepts in Nexus SecOps have 620 directed prerequisite relationships across 10 taxonomy categories. These relationships are not optional metadata -- they are the structural backbone that determines learning effectiveness.

Who Would Pay for This?¶

Knowledge Graph Schema¶

The knowledge graph contains 448 nodes (cybersecurity concepts, IDs C001--C448) connected by 620 directed edges (prerequisite relationships) across 10 taxonomy categories.

Storage format: JSON (vis.js compatible) with CSV interchange files for bulk analysis.

Interactive viewer: Knowledge Graph Viewer -- click any node to see its prerequisites, dependents, and linked chapters.

For full schema documentation including validation rules, see AI Architecture.

How AI Consumes the Graph¶

The Nexus Brain (autonomous agent) consumes the knowledge graph in multiple phases of its cognitive cycle:

1. PERCEIVE phase: Loads the full graph from graph.json. Counts nodes per category, identifies isolated or weakly-connected subgraphs, measures graph density.

2. ANALYZE phase: Traverses prerequisite chains to perform content gap analysis. For each concept node, checks whether the linked chapter has adequate depth. A concept with 5 prerequisites but only a paragraph of coverage is flagged as a gap.

3. REASON phase: Injects relevant subgraph context into LLM prompts. When the Brain is generating content about Cloud Container Security (C245), the prompt includes the full prerequisite chain:

   C001 (CIA Triad) -> C042 (Cloud Fundamentals) -> C178 (Container Basics) -> C245 (Cloud Container Security)
   

   This gives the LLM structural awareness -- it knows what concepts the reader has already learned and what to reference.

4. Adaptive Path Generator: Uses topological sort over the prerequisite DAG to generate personalized learning paths. Given a target concept and a set of "already known" concepts, it computes the minimal prerequisite chain. Available at Path Generator.

GraphRAG: Before and After¶

The GraphRAG demo shows the same cybersecurity questions answered with and without graph context. Key patterns:

The delta is most dramatic for ordering questions -- "What should I learn before threat hunting?" -- where prerequisite chains matter most.

How AI Was Used to Build This¶

Claude Code (Primary Development Tool)¶

All content and infrastructure was built across 17 iterative development sessions using Claude Code. Each session followed a structured protocol defined in CLAUDE.md:

• Read priorities from NEXT_SESSION.md
• Stabilize: mkdocs build --strict must pass
• Grow: execute scored priorities
• Update all state files and push

Claude Code authored all 50 chapters, 40 MicroSims, 26 labs, 56 attack scenarios, 150 purple team exercises, the gamification engine, the knowledge graph, CI/CD pipelines, and the custom dark-first theme.

Nexus Brain (Autonomous Agent)¶

The Brain runs Monday and Thursday via GitHub Actions, executing a 10-phase cognitive cycle (see AI Architecture for details):

graph LR
    P[PERCEIVE] --> RC[RECALL]
    RC --> A[ANALYZE]
    A --> R[REASON]
    R --> CR[CRITIQUE]
    CR --> RF[REFINE]
    RF --> ACT[ACT]
    ACT --> E[EVALUATE]
    E --> L[LEARN]
    L --> RM[REMEMBER]
    RM -.->|next cycle| P

The Brain autonomously generates threat intelligence blog posts, detection rules, attack scenarios, and content updates -- all validated through CI quality gates before merging.

Multi-LLM Routing¶

The Brain routes LLM requests across 4 free-tier providers using an epsilon-greedy multi-armed bandit:

Total infrastructure cost: $0. Every component runs on free tiers.

Content Scale¶

10-Minute Demo Script¶

Rubric Alignment¶