Teaching Intrusion Detection and Machine Learning Through a Freshman-Level Linux Lab

This proposed study presents a freshman-level Linux lab sequence designed to introduce beginning information technology, information systems, and cybersecurity students to applied intrusion detection, data collection, and machine learning concepts early in their degree program. Although students in introductory Linux courses often learn command-line navigation, file permissions, system services, logging, and basic networking, they may not yet see how these foundational skills connect to modern cybersecurity workflows. This lab addresses that gap by requiring students to install, configure, and observe a simple intrusion detection workflow using Linux authentication logs, repeated failed login events, blocking behavior, and collected system data. The topic is important because it focuses on how applied cybersecurity and data analytics concepts can be scaffolded into early undergraduate courses without requiring students to already have advanced programming, networking, or machine learning backgrounds.