← VCE Cyber Security

Machine learning analysis of network traffic

Using a trained model to classify network traffic as normal or anomalous, based on learned patterns rather than fixed rules.

Part of: VCE Applied Computing - U2O2 - Cyber Security — Module 53, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 127

Understanding Machine learning analysis of network traffic in VCE Cyber Security

What it does: This code trains a model on data, teaching it the patterns it will later use to classify traffic. A well-trained model can generalise and flag new patterns that resemble learned anomalies. Machine learning models require training data to learn what patterns to look for. Hardcoding the result skips the model entirely, defeating the purpose of ML-based analysis.

Common mistakes: Line 1 sets model to None instead of a trained model, so there's nothing for classify() to use. Line 1 sets a flag to skip loading the model, but classify() still needs a trained model to run.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Machine learning analysis of network traffic to a class →

This module's key terms are also in a printable crossword (Modules 51–60) and word search (Modules 41–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Machine learning analysis can detect traffic patterns that don't match fixed, predefined rules.
TrueFalse
Matches
pred = "normal"
↓
The mistake: hardcoding the prediction instead of using the model
Applying
Meanings
Term
Machine learning traffic analysis
Meaning
Using a trained model to classify network traffic as normal or anomalous, based on learned patterns rather than fixed rules.
Practice
model = load_model()
Testing
Gaps
= loadmodel()
Check Answer
Spots
1model = None
2t = get_traffic()

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Wolverine' badge — Fearless Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Machine learning analysis can detect traffic patterns that don't match fixed, predefined rules.
A. False
B. True ✓
ML models learn patterns from data, letting them flag traffic that fixed rules might miss.
2. A machine learning model must be trained before it can classify network traffic accurately.
A. False
B. True ✓
Training on traffic data teaches the model what normal and anomalous patterns look like.
3. Which classifies traffic in ML-based analysis: a trained model, or a fixed list of rules?
A. A trained model ✓
B. A fixed list of rules
The trained model analyses traffic patterns to decide if they are normal or anomalous.
4. ML-based analysis can only flag threats identical to ones it has seen before.
A. False ✓
B. True
A well-trained model can generalise and flag new patterns that resemble learned anomalies.
5. Which needs prior training on data: a machine learning model, or a fixed rule-based system?
A. A machine learning model ✓
B. A fixed rule-based system
Machine learning models require training data to learn what patterns to look for.

Match the Pairs

pred = classify(model, traffic) → Classifying traffic using a trained model
model = load_model() → Loading a previously trained model for use
ML models learn patterns from training data rather than fixed rules → model = train_model(data)
Classifying traffic flags it as normal or anomalous based on learned patterns → if pred == "anomaly": alert()
pred = "normal" → The mistake: hardcoding the prediction instead of using the model
pred = classify(t, model) → The mistake: swapping the argument order for classify()

Key Term

Machine learning traffic analysis
Using a trained model to classify network traffic as normal or anomalous, based on learned patterns rather than fixed rules.

Fill in the Blanks

1. model = load_model()
Hint: Type the name of the variable storing the trained model.
2. traffic = get_traffic()
Hint: Type the name of the function that captures network traffic to analyse.
3. prediction = classify(model, traffic)
Hint: Type the name of the function that classifies traffic using the trained model.
4. if prediction == "anomaly":
Hint: Type the comparison operator that checks if the prediction equals anomaly.
5. def classify_batch(model, traffic):
Hint: Type the name of the function that classifies a batch of traffic using the model.

Spot the Error

Question 1
A model = None
B t = get_traffic()
C pred = classify(model, t)
Line A — Line 1 sets model to None instead of a trained model, so there's nothing for classify() to use.
Question 2
A skip_model = True
B model = load_model()
C pred = classify(model, t)
Line A — Line 1 sets a flag to skip loading the model, but classify() still needs a trained model to run.
Question 3
A model = load_model()
B t = None
C pred = classify(model, t)
Line B — Line 2 sets t to None instead of real traffic data, so there's nothing for the model to classify.
Question 4
A model = load_model()
B use_fixed_rules = True
C t = get_traffic()
Line B — Line 2 switches to fixed rules instead of the trained model, defeating the point of ML-based analysis.
Question 5
A model = load_model()
B t = get_traffic()
C pred = "normal"
Line C — Line 3 hardcodes the prediction as normal instead of calling classify() to analyse the traffic.

Student with a class code? Join your class →