Section outline

  • Lesson Objective: Teach students how to be aware of network traffic patterns and identify what “doesn’t fit.” They will learn the difference between normal, benign network behavior and suspicious or malicious traffic. Key concepts include establishing a baseline of normal activity, recognizing signs of scans, breaches, or attacks in network traffic, and an intro to tools and techniques (like sniffers or basic IDS concepts) for monitoring. With AI increasingly used in both cyber defense and attack, a human who can spot subtle anomalies remains crucial – this lesson builds that intuition.