AI Development with Python for Cybersecurity and Digital Forensics: Student Materials

Abstract

Open educational resources for two four-hour workshops in a master's programme in network forensics. In both workshops students build something small with the help of an AI assistant and then establish how far it can be trusted. The code is short; the work is in the checking. Workshop 1: AI-assisted network detector. Students specify, build and validate a small Python classifier for suspicious network events, review a detector drafted by an AI assistant, keep a fault log, and compare validation designs and what they mean for an analyst's workload. Data: 2,000 synthetic, labelled connection records. Workshop 2: Generative AI for evidence-safe forensic triage. Students build a pipeline in which a language model helps to sort log evidence while deterministic checks and a human reviewer decide what is reported: parsing with line references, rule-based extraction, a strict output schema, verification of every statement against the lines it cites, adversarial tests and a scorecard. Data: 36 synthetic log lines from one fictional incident and nine stored model answers. Contents. A zip with three Jupyter notebooks (setup check with a readiness self-test, and one starter notebook per workshop), the two datasets with recorded SHA-256 hashes, stored AI-assistant answers and stored model answers, helper code, a student handbook and slides. The handbook and the slides are also provided as separate PDF files. Requirements. Python 3.11 or later with JupyterLab, pandas, scikit-learn and Pydantic. No network connection, AI account or GPU is needed: every task can be done with the stored answers in the package. Students write about 40 and 65 lines of Python respectively, plus short written answers; each code task has a specification and a check cell. Data. All data is synthetic and was generated for these workshops. IP addresses come from private and documentation ranges and domain names use reserved example names. The stored assistant and model answers are scripted teaching material, not recordings of any AI product. For teachers. Worked solutions, ground truth, an instructor guide, tests and build scripts exist as a separate instructor package. It is not published in this record, so that the answers are not publicly downloadable, and is available from the author on request. Status. Version 1.0.0 was built and run end to end on Python 3.11, 3.12 and 3.13. It has not yet been evaluated with students; the time budgets are estimates. Licence. Text, slides and data: CC BY 4.0. Code: MIT License. Funding. Funded by the Swedish Institute.