Chapter 12 — Probability and statistics
Lesson map
Lesson 12 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Base rates"]
N2["12.2 A worked population"]
N3["Lab — base-rate effect"]
N4["12.3 Reading the result"]
N5["12.4 Consequences"]
N6["12.5 Combining evidence"]
N7["12.6 Communicating uncertainty"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Base rates"]
N2["12.2 A worked population"]
N3["Lab — base-rate effect"]
N4["12.3 Reading the result"]
N5["12.4 Consequences"]
N6["12.5 Combining evidence"]
N7["12.6 Communicating uncertainty"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]
[Learning outcomes]
|
v
[12.1 Base rates]
|
v
[12.2 A worked population]
|
v
[Lab — base-rate effect]
|
v
[12.3 Reading the result]
|
v
[12.4 Consequences]
|
v
[12.5 Combining evidence]
|
v
[12.6 Communicating uncertainty]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes
You will (1) apply base rates to alerts and indicators; (2) compute the probability an alert is true; (3) explain why rare events produce many false alarms; (4) communicate uncertainty.
12.1 Base rates
Indicators of compromise (known bad domains, file hashes) generate alerts. Whether an alert means infection depends not only on the indicator's accuracy but on how common infection is — the base rate.
A rule that is right 99% of the time on clean hosts still produces many false alerts when clean hosts number in the thousands. The examiner needs both numbers, the rule's accuracy and the base rate, to judge what an alert means. The next example works through the arithmetic with the university's figures.
12.2 A worked population
The university has 10,000 hosts; 20 are infected. A detection rule flags 95% of infected hosts (sensitivity) and wrongly flags 1% of clean ones (false-positive rate).
These numbers are synthetic but realistic for a large campus: infection is rare, and even a good rule has some false positives. The question is what fraction of flagged hosts are truly infected. Writing the population as counts rather than percentages makes the answer easy to compute: multiply each group by its rate and compare the two results.
Lab — base-rate effect
"""Base-rate effect on an indicator alert (synthetic rates)."""
hosts = 10_000; infected = 20
sens, fpr = 0.95, 0.01
tp = infected * sens; fp = (hosts - infected) * fpr
print(f"true alerts={tp:.0f} false alerts={fp:.0f}")
print(f"P(infected | alert)={tp/(tp+fp):.3f}")
Run with python3 lab_baserate.py. Verified output:
true alerts=19 false alerts=100
P(infected | alert)=0.160
12.3 Reading the result
About 19 true alerts and 100 false alerts: only 0.160 (16%) of alerted hosts are actually infected. The rule seems accurate (95%, 1%), yet most alerts are false because clean hosts vastly outnumber infected ones.
In numbers: 95% of 20 infected hosts is 19, and 1% of 9,980 clean hosts is about 100. So 19 of about 119 alerts are true. If infection were ten times more common, the share of true alerts would rise sharply, which is why the same rule can be useful in one environment and noisy in another. With 200 infected hosts, it would give about 190 true and 98 false alerts, so about two in three alerts would be real.
12.4 Consequences
Responders triage alerts with further evidence before acting. Examiners do not treat a single indicator hit as proof.
Responders who act on every alert would spend most of their time on the 100 clean hosts. Triage means checking each alert against other evidence, such as a persistence key or an unusual logon, before isolating a machine. For ws-114, the alert was only the start; the process tree, proxy log and run key turned it into a finding that the security office could act on.
12.5 Combining evidence
If an alerted host also shows a matching persistence key and a known-bad file hash, the combined evidence is far stronger than the alert alone — provided the pieces are reasonably independent.
Independence matters because two indicators triggered by the same benign cause add little. A software update that touches the run key and a hash list that wrongly includes the update's DLL would both fire for the same harmless reason. Leah checks whether her pieces of evidence could share a cause before treating them as separate confirmation.
12.6 Communicating uncertainty
"The host matched an indicator; on its own, this has limited value because false alerts outnumber true ones in our environment. Further evidence confirms…"
The statement explains the limit in plain terms, uses the environment's own numbers, and then names the further evidence. For ws-114, that evidence is the process tree from the spreadsheet to rundll32, the proxy POST and the run key at 09:31:07. Readers who are not statisticians can follow the reasoning and see why the conclusion is stronger than the alert alone.
12.7 Estimating rates
Sensitivity and false-positive rates must be measured in the actual environment, not taken from vendor claims.
Vendors measure rates on their own test sets, which may differ greatly from a university network full of unusual research software. Grace's office estimates false-positive rates by reviewing a sample of alerts from a recent month and counting how many proved benign. That figure, with its sample size, is what Leah uses in her base-rate calculation, and she updates it when the rule changes.
Estimating from small counts
With only 20 infected hosts, the 95% sensitivity estimate is uncertain; 19 of 20 detected is compatible with a true rate somewhat lower. Leah reports counts alongside rates.
Worked example
ws-114 triggered the alert. Leah does not stop there: she lists the corroborating evidence — proxy POST to the fake page, run key, update.dll loaded in memory. Only with these does the report conclude ws-114 was compromised.
Synthetic case. The rates are invented.
Errors and limits
Assumed independence between evidence items is often imperfect; overstated combined strength is a common error.
Exercises
- EX034 — Lab figures. Report true alerts, false alerts and P(infected | alert). Rubric: 3 = 19, 100, 0.160; 2 = two; 1 = one; 0 = none.
- EX035 — Accurate yet wrong. Why are most alerts false despite 95% and 1%? Rubric: 3 = low base rate; clean hosts outnumber; 2 = partial; 1 = bad rule; 0 = none.
- EX036 — Corroboration. What corroborated ws-114's alert? Rubric: 3 = proxy POST, run key, DLL in memory; 2 = two; 1 = one; 0 = none.
Synthesis
Base rates decide what an alert means; corroborate before concluding.
Continue studying — chapter 12 of 40
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →