Teaching case study: introducing data analytics in an advanced cybersecurty course

This paper provides a group project-based teaching case that introduces students in a cybersecurity course to data security analytics. The case involves analyzing Web server log data of a fictional and deliberately vulnerable e-commerce Web site. Students are given a large Web Server log file in the combined format and asked to (i) analyze the data for evidence of potential intrusions and incidents and (ii) produce a detailed report documenting the tools they utilized, the results of analyses, and how they arrived at these results. To help guide the analyses, the students are given a list of questions whose answers can be used to uncover cybersecurity intrusions and compromises. By using traditional SQL relational databases, NoSQL databases, specialized log parsers, and/or specialized Security Analytics tools, the students will be able to conduct in-depth analyses, slice-and-dice the data across multiple dimensions/criteria, and present the results in a multitude of formats including tables, charts, time series, and/or dashboards.