Question: Imagine you are testifying in court about anomalous activity on the network. The attorney asks you how the Internet traffic indicated unusual activity and how you knew this was unusual.

Expert answer

When analyzing internet traffic, there are a few key indicators that can suggest unusual activity. For example, let's say that I noticed a sudden increase in traffic from a particular IP address. I would then look into where this traffic was coming from and what it was trying to access. If I found that the IP address was associated with a botnet or other malicious activity, I would then be able to report this as unusual activity.

Similarly, let's say that I noticed a change in patterns of internet traffic. Perhaps there was a sudden spike in traffic during normally inactive hours or maybe the traffic was coming from unexpected locations. If I were able to determine that this change in pattern was due to suspicious activity, such as an attempted DDoS attack, then I would again be able to report this as unusual internet traffic.

In both of these examples, the unusual activity was identified by looking for sudden changes in traffic patterns. By investigating further, I was able to determine that the increased traffic or the changed patterns were due to malicious or suspicious activity. This would then allow me to conclude that the internet traffic was indeed unusual and take appropriate action.