Network Traffic Monitoring and Threat Alerting for Energy Utilities

Energy utilities run infrastructure that attackers actively probe, and a compromise can mean physical consequences, not just data loss. Operators need to see hostile activity on their networks as it happens. This project builds a real-time monitoring and threat detection dashboard for exactly that need. The intern implements packet sniffing and network traffic analysis in Python, adding log file analysis and DNS query monitoring to catch signals such as beaconing, exfiltration attempts, and suspicious lookups. Events flow into the ELK Stack, where Logstash normalizes ingestion, Elasticsearch indexes everything for fast querying, and Kibana dashboards visualize traffic patterns and anomalies; alerting rules flag suspicious activity for immediate investigation. Docker packages the whole system into isolated security labs, so detection scenarios can be exercised safely and reproducibly. The intern gains practical fluency in network security fundamentals, including how traffic looks at packet level and how attacks appear in logs, plus experience operating the log aggregation stack at the center of real security operations. It is a strong demonstration of both offensive awareness and defensive engineering.