◇ OpenCyber Academy
Bachelor's · Chapter 12 · English

Chapter 12 — Probability and statistics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Probability and statistics

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Describing data"]
  N2["12.2 Rates and comparisons"]
  N3["12.3 Base rates"]
  N4["12.4 Common errors"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Describing data"]
  N2["12.2 Rates and comparisons"]
  N3["12.3 Base rates"]
  N4["12.4 Common errors"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Describing data]
    |
    v
[12.2 Rates and comparisons]
    |
    v
[12.3 Base rates]
    |
    v
[12.4 Common errors]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) describe data with summary statistics; (2) reason about rates and base rates; (3) avoid common errors.

12.1 Describing data

Network data are often skewed: most connections are small and short, a few are very large. In such data, the mean can mislead, because a single large transfer drags it upwards. Priya learns to report the median, which is the middle value, together with percentiles such as the 95th, which show the tail. For example, describing daily denied connections at a clinic, she reports a median of 40 and a 95th percentile of 180, which tells the reader both the usual level and how high bad days go.

12.2 Rates and comparisons

Counts are hard to compare when groups differ in size. A clinic with 60 staff will produce more alerts than one with 15, without being less secure. Rates, such as alerts per 100 devices per week, allow fair comparison. Priya also learns to compare against a baseline from the same place over time, since changes from normal are often more informative than absolute levels. A sudden rise in denied guest connections at one clinic matters more than a steady high level that has always been there.

12.3 Base rates

When a detector looks for rare events, even a small false alarm rate produces many false alarms. If one connection in ten thousand is malicious and a detector flags one percent of normal connections, almost all flagged connections are harmless. This is the base-rate problem described by Axelsson in his 2000 paper on intrusion detection. Priya works through the numbers by hand and sees why alert volume alone says little about whether a detector is useful, and why tuning thresholds is a constant part of network monitoring.

12.4 Common errors

Priya lists errors to avoid: treating correlation as cause, generalising from one clinic to all, ignoring missing data, and reporting precise-looking percentages from tiny samples. Saying "75 percent of devices were misplaced" sounds serious until the reader learns there were four devices. She reports sample sizes alongside every percentage. These habits are basic, but many security reports break them, and readers who make decisions based on such reports can be misled into spending money on the wrong problems. She also asks a classmate to check her figures before submission.

Worked example

With 10,000 connections, 1 malicious, a detector catching it and flagging 1% of the rest raises about 101 alerts, of which 1 is real.

Synthetic case. Numbers are synthetic.

Errors and limits

Percentages without sample sizes can make small findings look large.

Exercises

Synthesis

Robust summaries, rates and base-rate awareness prevent misleading conclusions from network data.

Continue studying — chapter 12 of 40

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →