CSAI2026 labs: Lab-2..Lab-6 (Practical + Solution, data), Module-2..Module-6 notebooks and datasets
This commit is contained in:
mikrotik
@@ -0,0 +1,241 @@
|
||||
{
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "eca32fd8",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"# Module 2 — Lab 1: Python Fundamentals for Security Analysis\n",
|
||||
"\n",
|
||||
"**Topics:** variables, data types, strings, type casting, operators\n",
|
||||
"\n",
|
||||
"\n",
|
||||
"> **Instructions:** Run the cells in order. Complete every `TODO`, then run the **Self-check** cell. Do not open the Solution notebook before attempting the tasks yourself.\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "da8ed50e",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Learning objectives\n",
|
||||
"\n",
|
||||
"After completing this lab, you will be able to:\n",
|
||||
"\n",
|
||||
"- store security information in variables and select suitable data types;\n",
|
||||
"- normalize log strings using string methods;\n",
|
||||
"- cast values read from logs to the required data types;\n",
|
||||
"- combine comparison and logical operators to flag suspicious activity.\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "0a4d2b7d",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"print(\"Hello, Cyber World!\")\n",
|
||||
"\n",
|
||||
"ip_address = \"198.51.100.14\"\n",
|
||||
"port_number = 443\n",
|
||||
"failed_logins = 7\n",
|
||||
"response_time = 0.125\n",
|
||||
"is_admin = False\n",
|
||||
"\n",
|
||||
"print(f\"IP: {ip_address} | Port: {port_number}\")\n",
|
||||
"print(type(ip_address), type(port_number), type(response_time), type(is_admin))\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "d700974b",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## 1. Strings in security logs\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "776c60e6",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"log_message = \" FAILED login for Admin from 198.51.100.14 \"\n",
|
||||
"url = \"https://example.com/login\"\n",
|
||||
"\n",
|
||||
"print(log_message.strip())\n",
|
||||
"print(log_message.lower())\n",
|
||||
"print(log_message.replace(\"FAILED\", \"DENIED\"))\n",
|
||||
"print(url[0:5])\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "a31e697c",
|
||||
"metadata": {
|
||||
"tags": [
|
||||
"exercise"
|
||||
]
|
||||
},
|
||||
"source": [
|
||||
"## 2. Normalize a username and extract the protocol\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "02195f3c",
|
||||
"metadata": {
|
||||
"tags": [
|
||||
"exercise"
|
||||
]
|
||||
},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"raw_username = \" AdMin \"\n",
|
||||
"\n",
|
||||
"# TODO 1: remove surrounding whitespace and convert the username to lowercase\n",
|
||||
"normalized_username = None\n",
|
||||
"\n",
|
||||
"url = \"https://example.com/login\"\n",
|
||||
"# TODO 2: use slicing to extract the string \"https\"\n",
|
||||
"protocol = None\n",
|
||||
"\n",
|
||||
"print(normalized_username)\n",
|
||||
"print(protocol)\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "c22bc685",
|
||||
"metadata": {
|
||||
"tags": [
|
||||
"exercise"
|
||||
]
|
||||
},
|
||||
"source": [
|
||||
"## 3. Type casting and operators\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "ee235adb",
|
||||
"metadata": {
|
||||
"tags": [
|
||||
"exercise"
|
||||
]
|
||||
},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"port_text = \"8080\"\n",
|
||||
"# TODO 3: cast port_text to int\n",
|
||||
"port_number = None\n",
|
||||
"# TODO 4: calculate the next port number\n",
|
||||
"next_port = None\n",
|
||||
"\n",
|
||||
"login_attempts = 7\n",
|
||||
"user_ip = \"198.51.100.14\"\n",
|
||||
"# TODO 5: flag as suspicious when attempts > 5 AND the IP is not localhost\n",
|
||||
"is_suspicious = None\n",
|
||||
"\n",
|
||||
"print(f\"Next port: {next_port}\")\n",
|
||||
"print(f\"Suspicious: {is_suspicious}\")\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "8bfdaf0b",
|
||||
"metadata": {
|
||||
"tags": [
|
||||
"exercise"
|
||||
]
|
||||
},
|
||||
"source": [
|
||||
"## 4. Calculate a basic risk score\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "1dde9681",
|
||||
"metadata": {
|
||||
"tags": [
|
||||
"exercise"
|
||||
]
|
||||
},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"failed_logins = 7\n",
|
||||
"is_admin = False\n",
|
||||
"is_off_hours = True\n",
|
||||
"\n",
|
||||
"# Rule: each failure adds 10 points, admin adds 25, and off-hours adds 15\n",
|
||||
"# TODO 6: calculate risk_score and require review at 60 points or higher\n",
|
||||
"risk_score = None\n",
|
||||
"requires_review = None\n",
|
||||
"\n",
|
||||
"print(f\"Risk score: {risk_score}\")\n",
|
||||
"print(f\"Requires review: {requires_review}\")\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "bdfa1e23",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Self-check\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"execution_count": null,
|
||||
"id": "8e9fa7c6",
|
||||
"metadata": {},
|
||||
"outputs": [],
|
||||
"source": [
|
||||
"assert normalized_username == \"admin\"\n",
|
||||
"assert protocol == \"https\"\n",
|
||||
"assert next_port == 8081\n",
|
||||
"assert is_suspicious is True\n",
|
||||
"assert risk_score == 85\n",
|
||||
"assert requires_review is True\n",
|
||||
"print(\"✓ Lab 1 completed\")\n"
|
||||
]
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"id": "c63bef39",
|
||||
"metadata": {},
|
||||
"source": [
|
||||
"## Reflection questions\n",
|
||||
"\n",
|
||||
"1. Why does `port_text + 1` fail while `int(port_text) + 1` works?\n",
|
||||
"2. What changes if you replace `and` with `or` in the `is_suspicious` condition?\n"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"display_name": "Python 3 (ipykernel)",
|
||||
"language": "python",
|
||||
"name": "python3"
|
||||
},
|
||||
"language_info": {
|
||||
"codemirror_mode": {
|
||||
"name": "ipython",
|
||||
"version": 3
|
||||
},
|
||||
"file_extension": ".py",
|
||||
"mimetype": "text/x-python",
|
||||
"name": "python",
|
||||
"nbconvert_exporter": "python",
|
||||
"pygments_lexer": "ipython3",
|
||||
"version": "3.11.6"
|
||||
}
|
||||
},
|
||||
"nbformat": 4,
|
||||
"nbformat_minor": 5
|
||||
}
|
||||
Reference in New Issue
Block a user