◇ OpenCyber Academy
Bachelor's · Chapter 6 · English

Chapter 6 — Discrete structures

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Discrete structures

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Sets of accounts"]
  N2["6.2 Logic for detections"]
  N3["6.3 Relations"]
  N4["6.4 Graphs and spread"]
  N5["6.5 Counting"]
  N6["6.6 Precision of definitions"]
  N7["6.7 Case use"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Sets of accounts"]
  N2["6.2 Logic for detections"]
  N3["6.3 Relations"]
  N4["6.4 Graphs and spread"]
  N5["6.5 Counting"]
  N6["6.6 Precision of definitions"]
  N7["6.7 Case use"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Sets of accounts]
    |
    v
[6.2 Logic for detections]
    |
    v
[6.3 Relations]
    |
    v
[6.4 Graphs and spread]
    |
    v
[6.5 Counting]
    |
    v
[6.6 Precision of definitions]
    |
    v
[6.7 Case use]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) use sets, relations and graphs to describe accounts and messages; (2) express detection conditions in logic; (3) reason about counting and combinations; (4) apply graph ideas to the spread of phishing.

6.1 Sets of accounts

Let R be the accounts that received the phishing email, C those that clicked the link, and S those that later signed in from an unusual country. C ∩ S identifies accounts that both clicked and showed suspicious sign-ins — the strongest candidates for compromise.

Writing the sets out makes the steps clear. R holds the 6,980 recipients, C the 33 who clicked, and S the accounts with unusual-country sign-ins in the following days. An account in S but not C might be compromised by another route, or might be genuine travel, so it is reviewed separately.

6.2 Logic for detections

A detection condition is a logical formula: "sign-in from a new country AND mailbox rule created within 60 minutes". Writing it in logic makes it precise enough to test and review.

Written precisely, the rule can be checked against cases. For s2047, a sign-in from a new country was followed six minutes later by a rule forwarding mail to an external address, so the rule fires. A student who travels home and signs in from there, but creates no rule, does not trigger it. Each part of the condition removes a source of false alarms.

6.3 Relations

"Account a sent mail to account b" is a relation. Together these relations form a directed graph of who emails whom.

The relation is built from the mail service's message log: each row gives a sender and a recipient. Lucas stores it as a dictionary mapping each sender to the set of recipients they have mailed in the previous month. Comparing that history with mail sent after a suspected compromise shows which recipients are new, and therefore suspicious enough to review.

6.4 Graphs and spread

When s2047 was compromised, the attacker sent phishing to its contacts. In the graph, the campaign spreads along edges from compromised nodes. Finding nodes with many new outgoing edges finds spreading accounts.

For s2047, the account had mailed about twenty people in the previous month, but sent the library-fines email to more than two hundred in under an hour after compromise. That jump in new outgoing edges stood out clearly against normal student behaviour, and the same check later helped confirm whether s3310 had been used to spread the campaign further.

6.5 Counting

With 6,980 recipients and 33 clickers, the number of possible clicker pairs is 33 × 32 ÷ 2 = 528. Counting helps estimate the effort of manual checks before starting them.

In practice, the SOC does not need to compare clicker pairs at all; the count shows why it should not try. Instead, it checks each clicker against sign-in logs, which takes 33 lookups. Choosing a method whose effort grows with the number of accounts, not the number of pairs, keeps the work manageable for a small team of two staff and six students.

6.6 Precision of definitions

Discrete thinking turns "many emails" into "more than 50 recipients outside the user's usual contacts in one hour".

With a precise definition, two analysts reviewing the same mailbox reach the same answer, and a program can apply it to every account. A vague one leaves each analyst to decide what "many" means, so results vary between shifts. Lucas tests his definition against s2047, which it flags, and a busy lecturer, which it does not. Both tests are kept with the rule.

6.7 Case use

Lucas computes C ∩ S from exported lists and finds two accounts: s2047 and s3310.

Both accounts were then examined in detail. s2047 had two successful unusual-country sign-ins and s3310 had one. Starting from the intersection meant Lucas reviewed two accounts first rather than all 33 clickers, though the remaining clickers were still checked afterwards, since a compromise might not show an unusual-country sign-in, for example if the attacker used a server in the same country. For each of the other 31, Lucas checked sign-ins, new mail rules and sent mail, and recorded the result in the case notes.

Paths

A path in the graph from s2047 to s3310 would show whether the second compromise came from the first account's phishing.

Worked example

Lucas draws a small graph of s2047's outgoing mail on the day: before 02:14, edges go to 3 regular contacts; after 02:14, 212 new edges appear in two hours. The graph view makes the spread obvious in a way a list of messages did not.

Synthetic case. Accounts and counts are invented.

Errors and limits

Sets are only as complete as the logs that build them; missing click data shrinks C.

Exercises

Synthesis

Sets, logic and graphs give precise meaning to compromise candidates and campaign spread.

Continue studying — chapter 06 of 40

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →