Project 5 — Read the Traffic

“So you, son of man, I have made a watchman for the house of Israel. Whenever you hear a word from my mouth, you shall give them warning from me.” — Ezekiel 33:7 (ESV)

Chapter: 5 — Network Services and the Watch on the Wire Due: End of Week 5 Submit: A link to a public GitHub repository containing your detector code, your findings, a REPORT.docx, and (Hard tier) a MEMO.docx. See Appendix A for the lab and Appendix B for running a local model if you bring AI into triage. Allowed tools: Python (or a language of your choice), tcpdump/Wireshark, standard Unix text tools, a vector/flow store if you want one. AI policy (Phase 1): you may use an AI copilot, but the traditional analysis must be done first/also, and your repo must include an honest AI_USAGE.txt stating what you delegated and what you verified by hand. The human owns every verdict in the report.

The Setup

Grace Covenant — a mid-sized church and K-8 Christian school sharing one campus network — just stood up its first AI estate: a small self-hosted inference service (an internal vLLM endpoint at 10.20.4.62), a Postgres + pgvector store at 10.20.4.20, a reverse-proxied web app, and the usual core services. The volunteer who used to “watch the network” graduated and moved away. The IT director hands you 30 days of NetFlow distilled into a baseline and one suspicious live hour, and says: “Something feels off this week. Tell me what’s happening on the wire, and tell me what I should actually do about it — I can’t take the donation server down on a Sunday over a false alarm.”

You are the watchman now. See, warn, and counsel the one who keeps the gate.

Setup (the starter)

This chapter’s code/ directory is your starting material:

• code/baseline_flows.csv — normal traffic plus a distilled per-host profile (mean/p95 bytes out, normal destinations and ports). This is your ground truth for “normal.”
• code/window_flows.csv — one live hour. Three anomalies are hiding in it.
• code/flow_baseline.py — a reference detector you may extend, replace, or reimplement. Reading it is required; copying it wholesale without understanding is not the assignment.
• code/gpu_fabric_check.sh — the east-west fabric prerequisite check, for the Medium tier.

Learning Targets

You will demonstrate that you can:

• Build an explainable per-host behavioral baseline from flow logs.
• Detect beaconing, port-scan/lateral-movement, and exfiltration anomalies and justify each with evidence tied to the baseline.
• Reason about false positives as a measured tradeoff, not a vibe.
• Reason about the network an AI workload requires (east-west fabric, RDMA prerequisites).
• Decide — and defend — which detections may be automated and which must stay behind a human gate.

Normal Tier

Goal: Be a correct watchman. Build the baseline, build the detector, find all three anomalies with evidence.

Required features

1. A program that ingests code/baseline_flows.csv and builds a per-host profile (at minimum: p95 bytes_out, the set of normal destinations, the set of normal ports).
2. The program scores code/window_flows.csv against that profile and emits findings.
3. It correctly identifies all three planted anomalies, naming for each: the host, the anomaly class (beaconing / port_scan / exfil), and the specific baseline deviation that triggered it.
4. A REPORT.docx that, for each finding, states the evidence in plain English a non-engineer director could follow.
5. Output is explainable — for every flag, your code (or report) can say why it fired.

Normal-tier rubric (out of 100)

Medium Tier (+up to 25% extra credit)

Goal: Measure the watchman’s eyes, and audit the fabric the AI workload rides on.

1. False-positive analysis. Sweep at least three sensitivity settings of your detector (e.g., exfil multiplier at 2×, 10×, 100×). For each, report how many findings you get and which are true vs. false positives. Plot or tabulate the precision/recall tradeoff and recommend a setting with a number and a justification. Explicitly identify which legitimate baseline traffic (the nightly git pull, the package-mirror sync) trips a too-tight threshold.
2. Beaconing rigor. Strengthen beaconing detection to also score temporal regularity (inter-arrival interval, not just byte variance), and show it on the planted beacon.
3. Fabric audit. Run or read code/gpu_fabric_check.sh and write a half-page in REPORT.docx: which prerequisites must hold for the inference host’s distributed traffic to stay compute-bound, what symptom each missing prerequisite produces, and the headline NVLink-5 per-GPU bandwidth figure (as of 2026) that motivates using NVLink/RDMA over PCIe/Ethernet for east-west traffic.

Hard Tier (+up to 25% additional extra credit)

Goal: Keep the gate. This tier grades the judgment an agent cannot supply.

Write MEMO.docx — a one-page incident memo to the IT director that makes a defensible recommendation for each finding: which detections (if any) you would wire to an automated response (auto-block, auto-quarantine), and which must stay behind a human approval gate — and why. Ground the decision in blast radius: what is the worst thing that happens if the automation acts on a false positive at the wrong moment (the Sunday donation server)? Reference the watchman-and-gate argument of §5.8 explicitly: the watching may be delegated to the wall; the keeping of the gate belongs to a named human who answers for the outcome.

The memo must name, for each recommended automated action, the named role that owns the decision and the rollback path. A recommendation an AI agent could have generated unaided earns no Hard-tier credit; we are grading your accountable judgment.

Submission

A public GitHub repo containing: your detector code, REPORT.docx (Normal + Medium write-ups), MEMO.docx (Hard tier), AI_USAGE.txt (what you delegated, what you verified), and a short README.txt with run instructions. Link it per Appendix A.

Hints (Read Before You Begin)

• Do the reps in the exercises first — especially Rep 7 (hunt by eye) and Rep 9 (cry-wolf/sleep). The project is those reps assembled.
• The exfil anomaly is large and obvious if you compare against the host’s own p95, not a global threshold. The beacon is small and easy to miss — look for regularity, not volume. The scan is a fan-out to admin ports the host never used.
• “Explainable” is a grading criterion, not a nicety. If you can’t say why a flag fired in one sentence, your detector is too clever.
• For the false-positive sweep, the legitimate periodic jobs in the baseline (git pull, package mirror) are your honest false-positive bait. Don’t suppress them by special-casing IPs; suppress them by reasoning about behavior.

What Mastery Looks Like (Beyond the Rubric)

A master watchman’s report reads like a witness statement, not a verdict: it separates what the data shows from what the analyst infers, marks confidence, and names the one piece of corroborating evidence that would change the call. And the Hard-tier memo refuses the easy answer. It does not say “automate everything” (reckless) or “automate nothing” (useless). It draws the line where blast radius crosses accountability, and it puts a human name on the gate.

Coach’s Note — The strongest submissions I’ve graded were not the ones with the cleverest detector. They were the ones where the analyst caught their own tool being confidently wrong — flagged a false positive their detector loved, explained why, and tuned it. That self-correction is the whole job.

When You’re Done

• All three anomalies found, each with baseline-grounded evidence.
• REPORT.docx is readable by a non-engineer director.
• Medium: false-positive sweep with a numbered recommendation; fabric audit written.
• Hard: MEMO.docx decides automated-vs-gated per finding, names the accountable human, justifies by blast radius.
• AI_USAGE.txt is honest about what AI did and what you verified.
• Every verdict in the repo is one you can defend out loud.

A theological footnote. Ezekiel’s watchman is given grave responsibility precisely because he is given real sight: “if the watchman sees the sword coming and does not blow the trumpet… his blood shall be required at the watchman’s hand” (Ezekiel 33:6, ESV). The sight is a gift; the accountability is the office. This week you build better eyes than any human has — a baseline that watches millions of flows tirelessly — and the temptation is to let the eyes also keep the gate, because it is faster and you are tired. Don’t. Delegate the watching; retain the office. A tool can see the sword. It cannot answer for the city. That is the doctrine of vocation, and it is why your MEMO.docx puts a human name on the gate.

See you next week.