OpenCyber Academy
Bachelor's · Chapter 35 · English
Course code: OCA-114Chapter 35: OCA-114-C035

Chapter 35 — Capstone proposal

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 Proposal structure"]
  N2["35.2 Scope that fits"]
  N3["35.3 Ethics and safety boundary"]
  N4["35.4 Acceptance criteria"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 Proposal structure"]
  N2["35.2 Scope that fits"]
  N3["35.3 Ethics and safety boundary"]
  N4["35.4 Acceptance criteria"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 Proposal structure]
    |
    v
[35.2 Scope that fits]
    |
    v
[35.3 Ethics and safety boundary]
    |
    v
[35.4 Acceptance criteria]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) write a capstone proposal with problem, question, scope, method, ethics and timeline; (2) define deliverables that can be assessed; (3) state safety and authorization boundaries; and (4) obtain supervisor sign-off on scope.

35.1 Proposal structure

A capstone proposal for this course has seven parts: problem statement (one paragraph with a cited source), research or design question, scope and exclusions, method, ethics and safety boundaries, deliverables with acceptance criteria, and a timeline with milestones. Keep it under four pages; a supervisor must be able to approve or reject it in one meeting.

Maya's proposal fits on three pages: a problem paragraph citing ATT&CK for ICS T0836 and CISA AA21-042A, a question about how accurately a rule-based monitor can classify Modbus writes, offline synthetic scope, and checkable deliverables.

35.2 Scope that fits

Bachelor's capstones fail more often from scope than from difficulty. "Secure LDHP" is not a capstone. "Design, implement and evaluate a passive Modbus write monitor for LDHP's synthetic control-zone capture, measuring precision and recall on six attack classes" is.

Maya's capstone question is close to the second: classify Modbus writes in a synthetic LDHP capture with rules from Chapter 27 plus a rate rule, and measure precision and recall. It is narrow enough to finish in one semester and still answers something LDHP's engineers care about: whether passive monitoring would have caught a write like the one in Chapter 29's tabletop. Scope also says what is out: other protocols, live captures and any enforcement.

35.3 Ethics and safety boundary

The proposal must state: all data are synthetic or provided by an owner under written agreement; no real controller or network will be probed; any tool is passive and offline; results that reveal a real product weakness go through coordinated disclosure. A supervisor signs this section.

For Maya's project the boundary is easy to state and must still be signed: the captures are synthetic LDHP traffic, the monitor reads files and never opens a network socket, and nothing is run against PLC-H or any real controller. If her work suggested a flaw in a real PLC product, it would go to the vendor first.

35.4 Acceptance criteria

Each deliverable needs a check: "the monitor processes the 8-case evaluation set and reports TP/FP/FN/TN with precision and recall" is checkable; "a good tool" is not.

Maya's three criteria are checkable in this way: the monitor processes the 8-case set and reports a confusion matrix; it reports precision and recall with their denominators; and it detects each of the six attack classes. The third is the one her evaluation later marks partly met. A criterion that cannot fail, such as "the monitor is useful", gives the examiner nothing to assess and the student nothing to defend.

Worked example (synthetic LDHP)

Maya's proposal. Problem: unauthorised setpoint writes such as those described in ATT&CK for ICS T0836 often go unnoticed by operators (motivated by CISA AA21-042A, where personnel noticed only by watching the screen). Question: how accurately can a rule-based monitor classify Modbus writes in a synthetic capture? Scope: offline, synthetic, Modbus/TCP only. Method: allow-list rules from Chapter 27 plus a rate rule; evaluation set from Chapter 38. Timeline: 12 weeks with milestones at weeks 3, 7 and 10.

Synthetic case — Lakeside District Heating Plant. The capstone uses only synthetic captures.

Errors and limits

Over-promising metrics in a proposal ("100 % detection") sets up failure. Proposals should anticipate a negative result being acceptable if well evidenced.

Exercises

Synthesis

A strong proposal is small, checkable and bounded by explicit ethics — and it allows an honest negative result.

Continue studying — chapter 35 of 40

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →

Worked answers

EX103. "Can a logistic-regression classifier trained on 20 synthetic LDHP supply-temperature features distinguish slow setpoint drift from normal load changes, measured by recall at a fixed 5 % false-alarm rate on held-out simulated runs, without any access to a real plant?"

EX104. "All data in this project are synthetic and generated by the scripts in the repository; no real controller, network or service will be contacted. The monitor only reads offline capture files. If the work reveals a weakness in any real product, it will be reported through the vendor's disclosure process and not published until coordinated."

EX105. "The evaluation report contains the confusion matrix for the 8-case set, precision and recall with numerators and denominators, the list of missed attack classes, the script commit hash and the seeds, and its numbers match a rerun of lab_eval.py."