Network Forensics

Network Forensics teaches systematic, defence-ready forensic examination of network traffic: packet capture analysis, protocol dissection, intrusion identification, flow record examination, and preparing court-admissible network evidence — aligned to ASD Essential Eight, ISM, and Australian federal court standards.

Hacking101 Network Forensics is taught using: Wireshark, tshark, Zeek (formerly Bro), Suricata, NetworkMiner, Arkime (formerly Moloch), and custom PCAP datasets simulating real Australian intrusion scenarios. Compliance benchmarks include ASD Essential Eight (network monitoring), ASD ISM 1534, and relevant state Evidence Act provisions for network-derived evidence.

Christopher Tran — Resident Machine Learning Expert
Christopher Tran provides the express tuteallage for the AI and machine learning components of this module. He will show you, step by step, how machine-learning-driven anomaly detection, behavioural baselining with neural networks, and predictive C2 detection algorithms converge to enhance and embolden network forensic analysis. Under his instruction you will build and apply real machine learning pipelines: automated anomaly scoring from network telemetry, behavioural baselining using recurrent neural networks (RNNs) and autoencoder architectures on flow-level features, predictive classification of command-and-control traffic patterns using gradient-boosted trees and deep-learning ensembles, and adversarial robustness validation against evasive malware that deliberately shapes its traffic to avoid detection — tooling designed to support and strengthen the forensic examiner's conclusions, never to replace them. Christopher ensures every student leaves with a working understanding of how AI augments the network forensics analyst's eye, from preprocessing packet captures through to generating court-ready visual evidence of intrusion indicators.

Ms. Linda Morrell — ASFDE (Australasian Society of Forensic Document Examiners)
Ms. Linda Morrell is a bonafide, dues-paying member of the Australasian Society of Forensic Document Examiners — the peak professional body governing forensic document examination across Australia and New Zealand. She has been directly involved in hundreds of Australian cases spanning civil fraud, probate disputes, identity theft, and criminal forgery prosecutions. Her expert opinions on signature fraud and questioned document examination have been tendered and accepted in Australian courts, where she is recognised as a respected authority whose testimony withstands adversarial cross-examination. In this module, Ms. Morrell provides the express tuteallage for the evidence-handling methodology, courtroom preparation, and professional practice components that ensure network-derived evidence meets Australian courtroom admissibility standards. She teaches chain-of-custody for digital network captures, structured opinion formation on network-derived findings, expert report writing for intrusion evidence, and witness-box conduct — the same standards she herself applies when stepping into an Australian courtroom. Her involvement ensures that every technique taught in this course meets the admissibility benchmarks expected by Australian federal and state courts.

What PCAP datasets do you use?
Hacking101 provides custom PCAP datasets built from real Australian intrusion scenarios, plus curated captures from public repositories (Maldoc, Stratosphere IPS, etc.). You also learn to generate your own in the lab.