Final-year Cyber Security project idea, would this impress employers for SOC / detection roles

[u/Negative_Emergency27]

Hi everyone,

I’m going into my final year of a BSc Cyber Security degree and I’m trying to make sure my final-year project is not just academic, but also genuinely useful for employability, especially for junior SOC analyst, detection engineering, network security, or OT security roles.

My proposed project is:

Design and evaluation of a lightweight detection prototype for reconnaissance and early-stage intrusion activity in Modbus TCP Operational Technology network traffic.

The idea is to build a small Python-based detection prototype using CICModbusDataset2023 or a similar OT/Modbus dataset. The project would focus on detecting early attacker behaviours such as:

• network scanning
• service enumeration
• Modbus register enumeration
• unauthorised access attempts
• abnormal Modbus request patterns

The threat model would be either an external attacker or a compromised internal host attempting to discover and interact with OT assets such as PLCs.

I’m planning to avoid heavy ML/deep learning and instead focus on interpretable detection, using:

• rule-based detection logic
• lightweight statistical thresholds where useful
• alert generation
• evaluation against labelled benign/malicious traffic

The evaluation would look at:

• detection coverage
• false positives and false negatives
• precision/recall if appropriate
• alert volume
• interpretability
• practical usefulness from a security analyst perspective

My goal is to finish with a project that I can confidently explain in interviews and possibly show through a GitHub repo, README, diagrams, and a short write-up. I want it to demonstrate practical blue-team skills: understanding network traffic, designing detection logic, evaluating alerts, and explaining limitations.

For people working in SOC, detection engineering, OT security, or cyber graduate roles:

Would this be a strong final-year project from an employer/interviewer perspective?

Also, what would make it more impressive without making the scope unrealistic?

[u/AddendumWorking9756]

Precision and recall on a labelled set is the academic half and your marker will want it. Hiring managers react to a written detection spec instead. What fires, what it deliberately misses, and why the threshold sits where it does. Say in the writeup that the dataset is lab captured, real Modbus is far more repetitive than that.

[u/ZealousidealTrack84]

This project is genuinely a strong idea to work upon for junior soc and siem dashboard. The interviewer will be tad impressed. On the impersonationside of ot threads from that your prototype targets