JUSTIFICATION AND OVERVIEW:
In complex cyber operations and investigations, foundational packet analysis is not enough. Advanced adversaries leverage encrypted channels, obfuscation techniques, and multi-stage command-and-control to evade detection.
Modern analysts must therefore move beyond surface-level traffic review and apply advanced methodologies to extract insight from fragmented, encrypted, or incomplete data sources—often at scale.
This course is built for operators, analysts, forensic examiners, and incident responders who have already completed the Basics of Data Analysis course and are ready to move into deeper analytical territory. It focuses on interpreting hard-to-spot patterns, correlating across massive datasets, and using Python and scripting tools to reduce manual workload.
Participants will learn how to pivot across time, protocol, and metadata dimensions, identify indicators within encrypted or tunneled traffic, and build scalable workflows for sustained operational capability.
The Advanced Data Analysis– Deep Dive into PCAPs & Data at Scale course incorporates real-world intrusion data, custom-built threat emulations, and analysis of adversary tradecraft observed in-the-wild.
This ensures students develop the capability to operate at the level expected of a national cyber defense analyst or field-level cyber intelligence specialist.
BOTTOM LINE UP FRONT:
This course develops true data analysts—equipping students with advanced capabilities to extract, correlate, and attribute network-based threat activity, including within encrypted and obfuscated datasets. It builds scalable analysis pipelines and enhances operational confidence in real-world, high-pressure data environments.
CONDITIONS OF ENTRY:
Students must have completed the Basics of Data Analysis–Reading PCAPs & Data at Scale course (or proven operational equivalent). Strong familiarity with Wireshark, Tshark, and flow-based packet analysis is required. Basic understanding of Python scripting is strongly recommended; support will be provided in-session for unfamiliar students.
INDICATIVE COURSE CONTENT:
Module 1: Advanced Packet and Flow Dissection
• Cross-protocol correlation (DNS > HTTP > TLS > C2)
• Fragmented traffic reconstruction and session reassembly
• Advanced use of Tshark and command-line automation
Module 2: Anomaly Detection in Encrypted & Obfuscated Traffic
• Identifying patterns in TLS handshakes, JA3 fingerprints, and SNI values
• Recognising covert channels (DNS tunneling, HTTP/S exfiltration, port-hopping)
• Metadata correlation without payload inspection
Module 3: Scalable Analysis Techniques & Automation
• Building reusable Python scripts for log parsing and PCAP reduction
• Introduction to pandas, Scapy, and flow-based triage
• Integrating with SIEM/XDR/ELK pipelines
Module 4: Attribution, Threat Emulation, and Pivoting
• Tracing attacker infrastructure through open-source pivoting techniques
• Attribution basics: from flow to actor profile
• Threat actor emulation: creating and anlysing synthetic APT-Style intrusions.