Treven Stidham

Network Engineering & Cybersecurity

Treven
Stidham.

Treven Stidham Cybersecurity Network Engineering Political Science

About Me

Hello, I’m Treven! I'm currently a Senior pursuing a triple major in Cybersecurity, Network Engineering, and Political Science at Purdue University. In addition to my full-time studies, I'm currently a Teaching Assistant for a 300-level Network Engineering course and working as a Network Planning Engineer at L3Harris as a part of a Co-Op.

I previously completed my Associates in Cybersecurity at Ivy Tech Community College while serving as an Information Technology Specialist in the Indiana Army National Guard.

I take immense pride in my drive and independence, as I've completely self-funded my way through education. Whether it's policy or applied computing, that same sense of ownership translates into everything I do.

Portrait of Treven Stidham
Current Tech Stack?
Lenovo ThinkPad X201T

Introducing the X201T Thinkpad

  • Release DateMarch 2010
  • Processori7-640LM (2.13 GHz)
  • Memory8GB DDR3
  • Storage500GB SSD
  • Display12.1-inch WXGA (1280 × 800)
  • GPUIntegrated Intel GMA HD
  • Operating SystemLinux Mint 22.3
All Time Favorite Book?
Cover of Shadow & Claw by Gene Wolfe

Shadow and Claw by Gene Wolfe.

Shadow and Claw is the first half of Gene Wolfe’s ‘Book of the New Sun,’ which is frequently cited as one of the greatest Science Fiction/Fantasy books ever written. I read this after finishing the Dune saga, and it quickly became my all-time favorite fictional book. Not much can be said about this without getting into spoiler territory, but this book most definitely deserves its near-mythical reputation.

Got a Study Playlist?
Bill Evans Trio — At the Village Vanguard album cover

Bill Evans Trio

The Bill Evans Trio, and the Modern Jazz era more broadly, never fails to evoke a concentrated nostalgic haze. There’s a seamless quality to the genre that makes it the ultimate backdrop for long study sessions. If the image of a smoky 1960s dive bar resonates with you, give the Bill Evans Trio a spin. Over a decade later, My Foolish Heart remains one of my all-time favorite tracks.

Why Political Science?
An illustration representing political science and governance

How can you secure something if you don't understand it?

While technology may supply the tools for defense, it's policy that dictates how and when we use them. With nation-state cyber threats on the rise, I believe that a thorough understanding of international relations and governance is critical for staying competitive in the modern cybersecurity landscape.

Projects

Honeypot Project logo

The T-Pot Honeypot

Deployed a T-Pot multi-honeypot sensor on a Miami VPS and captured 60 days of live attack telemetry — 150M+ IDS events across 77K+ unique source IPs — then analyzed attacker credentials and geography.

T-PotSuricataELK / KibanaHoneypot
View Project Breakdown
NNT — NOC Note Taker logo

NNT — NOC Note Taker

Built a JavaScript tool that parses through device log output, and auto-generates ServiceNow ticket documentation. Cut the average time to complete tickets from ~2:15 minutes to 49 seconds. Tool included functionality for ~70% of common NOC tickets.

JavaScriptServiceNowLog ParsingNetwork Automation
View Project Breakdown
Coming soon

More Coming Soon

Certifications

← Back to portfolio

Project case study · Independent

The T-Pot Honeypot

Deployed a T-Pot multi-honeypot sensor to a VPS located in Miami in order to safely attract, capture, and analyze real Internet attack traffic. Over a 60-day window the Honeypot recorded more than 150 million IDS events from 77,000+ unique source addresses. Data on attempted usernames, passwords, as well as attacker geography distribution was captured, aggregated, and analyzed in real time.

T-Pot 20.06DebianDockerSuricata IDSCowrie / DionaeaElasticsearch + KibanaVultr VPSThreat intelligence

Project Introduction

This project set out to answer a simple question with real data: what actually happens to a fresh server the moment it is exposed to the public internet? Rather than read about it, I stood up a honeypot — a deliberately exposed system whose only job is to be attacked while safely recording everything that touches it.

I used T-Pot, a containerized platform that runs a broad collection of honeypots (emulating SSH, Telnet, SMB, FTP, HTTP, databases, and industrial protocols) alongside a Suricata intrusion-detection engine and an Elasticsearch/Kibana analytics stack. The sensor was hosted on a rented VPS in Miami, Florida, a location chosen deliberately to sit close to high-volume traffic and maximize the attack data collected for later analysis.

The VPS sign-in prompt attackers were presented with
Figure 1 — The Honeypot from the attacker's perspective.

How It Was Built

01

Imaging and VPS

Downloaded the official T-Pot 20.06 ISO from the Telekom Security project, uploaded it to a Vultr VPS provisioned in Miami.

02

Install & Harden

Installed the Debian-based T-Pot "Standard" edition, set separate console and web credentials (20 characters).

03

Expose & Collect

Brought the Honeypot online behind a VPS's public address, and left the sensor to collect live traffic for ~2 months.

Vultr VPS overview showing Miami region, 4 vCPU, 12GB RAM, 260GB NVMe
Figure 2 — VPS Dashboard
T-Pot web dashboard landing page with tool links
Figure 3 — T-Pot Dashboard

Results

150.9MSuricata IDS events
77,132Unique source IPs
711Unique JA3 TLS fingerprints
~60 daysContinuous collection
Suricata events dashboard with event totals and a world attack map
Figure 4 — Suricata event volume, unique sources, and geographic distribution.
T-Pot live attack map with global source markers
Figure 5 — Screenshot of Live attack map (real-time source geography of inbound events)

Credential Analysis

Because the Honeypot accepts and logs login attempts, the data set is a direct window into the username and password combinations attackers spray across the internet. The clouds below are weighted by frequency with larger words being tried more often.

Word cloud of most-attempted usernames, dominated by root and admin
Figure 6 — Most-attempted usernames.
Word cloud of most-attempted passwords, dominated by 123456 and blank entries
Figure 7 — Most-attempted passwords.
01

Defaults Dominate

root and admin overwhelmed the username attempts, while 123456, blank passwords, and password led the password list — evidence that unchanged factory defaults remain an attacker's first guess.

02

Botnet Fingerprints

Recognizable automated-scanner strings such as 345gs5662d34 appeared near the top of both lists, indicating much of the traffic came from indiscriminate IoT botnet scanners rather than hands-on-keyboard actors.

03

Exposure is Enough

Attempts arrived continuously from tens of thousands of distinct hosts worldwide, confirming that exposure alone — not notoriety — is enough to draw sustained automated attack traffic.

Lessons Learned

Beyond the raw metrics, this project provided clear, first-hand proof: any internet-facing asset is targeted by automated scans almost instantly. It underscored that fundamental hygiene—disabling default accounts and enforcing key-based authentication—neutralizes the vast majority of indiscriminate attacks. Aggregating raw telemetry into structured, high-signal dashboards using Suricata, Elasticsearch, and Kibana reinforced the real-world value of SIEM and IDS workflows, solidifying my interest in enterprise security architecture.

← Back to portfolio

Project case study · NOC internship

NNT — NOC Note Taker

A JavaScript tool that automates the most repetitive part of Network Operations Center work: reading device logs and writing tickets. NNT parses raw log output, classifies whether links and services are up, down, or up-but-not-passing-traffic, and produces a ready-to-submit ServiceNow ticket — cutting average ticket time from ~2:15 to under 49 seconds and covering roughly 70% of the tickets a NOC sees.

JavaScriptServiceNowLog parsingAutomationMobaXtermNetwork Operations

Project Overview

The NNT started out as an independent project aimed at automating the production of concise, relevant documentation for the most encountered tickets in a real Network Operations Center (NOC). The tool quickly grew to account for roughly 70% of all tickets encountered in the NOC it was tested in. The tool generates a concise summary of the event, affording non-technically savvy customers the ability to see what really goes on inside their network.

Beyond summarizing, the NNT is actually able to diagnose specific issues, and generates a relevant ServiceNow ticket description. The tool distinguishes between links and services that are up, down, and up but not actively passing traffic. The tool effectively removed the need to type anything while completing ticket documentation in ServiceNow.

Under the Hood

01

Parse & classify

Reads raw CLI log output from a device session and determines the real state of each link and service — up, down, or up but not passing traffic — rather than leaving that judgement to the specialist.

02

Auto-document

Generates the recommended ServiceNow ticket description alongside a condensed log summary, so completing a ticket requires essentially no typing.

03

Broad coverage

Handles ~70% of common ticket types. Paired with MobaXterm macros, the slowest remaining step becomes simply logging into the device.

The NNT tool interface
Figure 1 — The NNT interface. All proprietary and network-sensitive details are redacted.

Before & After

The clearest way to see what NNT does is to look at the same incident before and after it runs. Noisy device output is condensed into a focused summary — here, from roughly 129 lines down to 80 — so a specialist spends effectively zero time reading logs.

Raw unformatted device logs pasted into Notepad, about 129 lines
Figure 2 — Raw device logs (~129 lines), unformatted.
Device logs after NNT formatting, about 80 lines
Figure 3 — The same output after NNT (~80 lines), anonymized.

Impact

The tool reshaped what the job's bottleneck even was. With NNT, the most time-consuming part of closing a ticket became logging into the device — reading and interpreting logs dropped to essentially nothing.

48.87sAvg ticket, down from ~2:15
~70%Of common NOC tickets covered
1,209Tickets in a 10-week internship
3.6×The previous intern record (331)

Security Notes

Redaction: Every screenshot included in this project writeup has had all proprietary information removed, and all network details anonymized. The NNT remains as an internal productivity tool.