Chapter 6 — Discrete structures | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Sets and relations"]
  N2["6.2 Graphs"]
  N3["6.3 Paths and components"]
  N4["6.4 Shared infrastructure trap"]
  N5["6.5 Directed versus undirected"]
  N6["6.6 Degree as a warning sign"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Sets and relations"]
  N2["6.2 Graphs"]
  N3["6.3 Paths and components"]
  N4["6.4 Shared infrastructure trap"]
  N5["6.5 Directed versus undirected"]
  N6["6.6 Degree as a warning sign"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Sets and relations]
    |
    v
[6.2 Graphs]
    |
    v
[6.3 Paths and components]
    |
    v
[6.4 Shared infrastructure trap]
    |
    v
[6.5 Directed versus undirected]
    |
    v
[6.6 Degree as a warning sign]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) use sets and relations to model indicators and actors; (2) represent intelligence as graphs; (3) reason about paths and connected components; (4) recognise the limits of link analysis.

6.1 Sets and relations

Each feed is a set of indicators. Union combines feeds; intersection shows agreement; difference shows what only one source holds. A relation pairs elements: (domain, resolves-to, address). STIX 2.1 relationship objects express exactly this — a source object, a relationship type and a target object.

Amara uses set operations to compare two HSSC feeds and finds that they overlap in only a third of their indicators. Agreement between independent sources raises confidence; indicators found in only one feed are not wrong, but they need more checking before a block.

6.2 Graphs

Treat indicators, malware families and campaigns as nodes and relationships as edges. Graphs make pivots visible: two phishing domains that resolved to the same address become linked through that address node. The Diamond Model's four vertices — adversary, capability, infrastructure, victim — are themselves a small graph for each event.

Amara builds a small graph from one HSSC report and checks each edge against its source before drawing conclusions. Each edge carries the source that reported it and the date, so a link that rests on an old or weak report can be identified and, if needed, removed without rebuilding the whole graph.

6.3 Paths and components

A path connects two nodes through edges. A connected component is a group where every node reaches every other. Analysts sometimes treat a component as "one campaign". That is a hypothesis, not a fact.

Amara writes "these indicators form one connected group, which may be one campaign" rather than "this is one campaign". She then looks for evidence that would separate them, such as different delivery techniques or timing. A component built through a shared hosting address, for example, may join unrelated actors, so the hypothesis needs testing before anyone acts on it.

6.4 Shared infrastructure trap

Shared hosting, content delivery networks and cloud addresses connect unrelated customers. One address serving thousands of domains links them all in a naive graph. Before trusting a link, ask how many other things share that node; high-degree nodes are often noise.

Amara checks the number of domains on each address with the hosting provider's public information or a passive DNS record, and drops edges through nodes that serve many unrelated sites. She records each removed edge and the reason, so a reviewer can see the choice.

6.5 Directed versus undirected

"Domain resolves to address" has a direction; "appeared in the same report" does not. Keep direction where it carries meaning, or you will reason backwards.

Amara stores each relationship with its type and direction, following the STIX relationship objects. Reversing an edge, for example reading "address resolves to domain", could lead to the false conclusion that every domain on a shared address belongs to the same actor. Undirected links like co-occurrence in a report are kept separate and treated as weaker evidence, since they show only that two things were mentioned together.

6.6 Degree as a warning sign

The degree of a node is the number of its edges. A sudden hub in a small intelligence graph is worth inspecting: it might be a genuine command server, or a public resolver, a webmail provider or a mistaken parsing artefact.

Amara adds a degree check to her graph script that lists any node above a chosen threshold for manual review. The threshold is set from the graph's normal shape, and each flagged node is checked against public information before it is kept. A public resolver or a webmail provider is removed with a note; a genuine server is kept and highlighted.

Worked example

Amara links six HSSC phishing domains. Five join into one component through a single address. She checks the address: it belongs to a large hosting provider and serves many unrelated sites. She removes it as a pivot; the six domains split into three small groups, two linked by a shared registration email pattern. Her note says "two domains may be related; evidence weak".

Synthetic case. The domains and hosting details are invented.

Errors and limits

Graphs show co-occurrence, not intent. A drawing with many lines looks convincing; test each edge.

Exercises

EX016 — Set operation. Which set operation lists indicators only HSSC holds, not HCHT's own blocklist?
Show marking criteria
Rubric: 3 = difference (HSSC − HCHT); 2 = named but direction wrong; 1 = intersection; 0 = none.
EX017 — High degree. Why did Amara drop the hosting address as a pivot?
Show marking criteria
Rubric: 3 = shared/high-degree node links unrelated sites; false linkage; 2 = partial; 1 = it was malicious; 0 = none.
EX018 — Diamond vertices. Name the four vertices of the Diamond Model.
Show marking criteria
Rubric: 3 = adversary, capability, infrastructure, victim; 2 = three; 1 = one or two; 0 = none.

Synthesis

Sets and graphs organise intelligence; check high-degree nodes, keep direction and treat components as hypotheses.

Continue studying — chapter 06 of 40

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →