CYBERSECURITY / NETWORKING
Authentication & Network Policy
Local Python exercises in suspicious-login detection and default-deny network segmentation.
← All projectsObjective
Recognize failed-login patterns and reason about allowed access between network zones.
Tools & architecture
Python standard library, synthetic authentication events, network policy model. Two independent local components: an event-window detector and a network policy evaluator. Neither is a deployed SIEM or live firewall.
Development & challenges
Detection groups events by source, account and host inside five minutes. The policy model separates management, employees, servers and guests.
Security considerations
Fictional accounts and documentation IP ranges. Policy evaluation sends no packets and changes no devices.
Testing & verification
The saved test record contains two alerts, six authentication tests and five network-policy tests.
Outcome & limitations
Local executable exercises. GNS3 traffic validation, packet captures and Wazuh or Splunk collection remain future work.
What I learned
An alert is an investigation prompt. User mistakes, shared devices and NAT can also produce repeated failures.
Source code is maintained in my private GitHub repositories.