Back in college, I became fascinated by cybersecurity claims that state-sponsored actors particularly from China were responsible for a large share of global cyberattacks. Rather than accept that narrative at face value, I wanted to see what kind of activity I could actually observe myself.
So, I decided to build a home security operations center (SOC) using Security Onion an open-source platform for intrusion detection, network monitoring, and log management. I repurposed an old HP 110-021 desktop, upgraded the RAM to 16 GB, and set up Ubuntu Server running inside a virtual machine.
To simulate a small attack surface, I forwarded common ports (21, 22, 80, 443) and configured Wireshark to inspect network traffic. At first, I only saw traffic from the host itself until I learned I needed a switch with port mirroring capability. A quick trip to Fry’s Electronics and a $40 TL-SG108E switch later, I was finally seeing full network visibility.
Within hours of going live, the server began receiving thousands of intrusion attempts. Reviewing alerts in Squert, I found that the majority originated from IPs geolocated to China. That experiment taught me two key lessons:
The internet is far more hostile than it appears from behind a consumer router.
Even small, experimental systems benefit from layered defenses and segmentation.
Looking back, that early project helped spark my passion for threat detection, a curiosity that still drives my work today.