Network Packet Analysis as a Unit of Assessment: Identifying Emotet

Abstract

Cyber security is growing in importance globally and network forensics is an important component of a cyber security curriculum. Wireshark is a common tool used for the analysis of network traffic but it is seldom documented in academic literature how packet analysis is used in the teaching and learning within cyber security courses. In this poster, the practice of using Wireshark and the analysis of network traffic is documented with details about how packet analysis was used as an assessment approach, where students were required to identify the malware of Emotet, and its associated network traffic behaviour. Our ongoing and future work include implementing and evaluating the approach of using packet analysis as a form of assessment, with the aim of this poster to elicit feedback from conference participants on the practice itself, and how it can be used to ensure effective student learning.