Investigate unusual traffic

Course · Part 2 · Part 2 exercises · Practice notebook

The same 95 MB/min transfer can be ordinary for a backup server and surprising for an office workstation. Find out what that comparison establishes.

Core route. Keep cutoff 3. Predict and compare the same 95 MB/min event against office and backup baselines. Reveal its context. Then inspect the unapproved 95 and slow unauthorised 12 MB/min cases. Record what the number establishes and one missing security observation. Use the displayed spread; calculating it is not required.

Teaching steps: predict, do, observe, explain

1. Use Volume view, Scheduled backup, Office workstation and cutoff 3. Predict whether 95 MB/min will look unusual.

2. Keep the event fixed; switch to Backup server. Read mean, spread and distance. Did the transfer itself change?

3. Reveal evidence. Compare Unapproved transfer, then Slow unauthorised transfer with the office baseline. Explain the miss.

4. Select Scheduled backup again, then Traffic evidence. Read its fields: why is 95,000,000 bytes in 60 s equal to 95 MB/min?

5. Compare the flows with equal volume. Which process or approval record establishes authorisation? Save one missing observation.

The in-demo step controls move between instructions. They never perform the next experiment for you. Record one observation before moving on.

Try it with a partner

1. Keep Scheduled backup selected. Switch from office to backup baseline without changing the event.
2. Reveal investigation evidence. Now choose Unapproved transfer: the volume is identical, but its context differs.
3. Select Slow unauthorised transfer and the office baseline. Explain why an ordinary-looking volume can still be malicious.

Explain what you observed

Write: “I changed ___. I predicted ___. I observed ___. The missing evidence is ___.” Swap operator and observer for a second attempt.

This is a fitted mean-and-spread baseline, not a sequence network or a complete intrusion detector. Cutoff 3 is a chosen teaching rule, not a guaranteed false-alarm rate or a probability that the event is malicious. The eight historical observations do not establish a Gaussian distribution or a calibrated operating point. The baseline has no process or authorisation evidence until you reveal the authored context.

If the experiment is unavailable

Compare an observation of 95 with historical values around 10 and values around 100. List the extra evidence needed to establish authorisation.

The record supplies source, destination and the TCP/443 port. A port number alone does not prove encryption, a particular application or authorisation; request the relevant connection/process and approval evidence.

Explain it to your partner

Question: The same upload looks ordinary for a backup server. Does that establish permission?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: The baseline measures unusual volume. Permission requires separate process and approval evidence.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.