OpenCyber Academy
Doctoral research · Chapter 8 · English
Course code: OCA-206Chapter 08: OCA-206-C008

Chapter 8 — Defense and publication plan

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["8.1 Claim-register audit"]
  N2["8.2 Examiner question families"]
  N3["8.3 Publication sequencing"]
  N4["8.4 Coordinated disclosure"]
  N5["8.5 Translation for practice"]
  N6["8.6 Post-doctoral program"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["8.1 Claim-register audit"]
  N2["8.2 Examiner question families"]
  N3["8.3 Publication sequencing"]
  N4["8.4 Coordinated disclosure"]
  N5["8.5 Translation for practice"]
  N6["8.6 Post-doctoral program"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes and connection]
    |
    v
[8.1 Claim-register audit]
    |
    v
[8.2 Examiner question families]
    |
    v
[8.3 Publication sequencing]
    |
    v
[8.4 Coordinated disclosure]
    |
    v
[8.5 Translation for practice]
    |
    v
[8.6 Post-doctoral program]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes and connection

After this chapter you can (1) audit a claim register before the defense, (2) prepare for examiner question families, (3) sequence publications, (4) route product vulnerabilities through coordinated disclosure, and (5) translate findings for operators and standards bodies. It completes the project begun in Chapter 1.

8.1 Claim-register audit

Every claim in the thesis needs evidence, scope and a falsifier, and must avoid overreach wording. Lab 8 automates the first pass.

# Lab 8: audit a thesis claim register (synthetic). Every claim needs evidence, scope and a falsifier.
claims = [
 {"id": "C1", "text": "Residual CUSUM detects replay on Plant A tank model", "evidence": "Lab3 100/100", "scope": "simulated tank, single-sensor replay", "falsifier": "replay+flow"},
 {"id": "C2", "text": "Method secures water utilities", "evidence": "", "scope": "", "falsifier": ""},
 {"id": "C3", "text": "Band alarms miss replay", "evidence": "Lab3 0/100", "scope": "band +/-1.5", "falsifier": ""},
 {"id": "C4", "text": "Detection holds on testbed T2", "evidence": "Ch5 table 5.2", "scope": "T2, class A replay", "falsifier": "class B: flow meter also spoofed"},
]
overreach = ("secures", "prevents all", "guarantees", "real-world")
for c in claims:
    issues = [f for f in ("evidence", "scope", "falsifier") if not c[f]]
    if any(w in c["text"].lower() for w in overreach): issues.append("overreach wording")
    print(c["id"], "PASS" if not issues else "REVISE: " + ", ".join(issues))

Expected output:

C1 PASS
C2 REVISE: evidence, scope, falsifier, overreach wording
C3 REVISE: falsifier
C4 PASS

C2 must be deleted or narrowed; C3 needs a falsifier (for example "a band narrow enough to catch replay would exceed the shift false-alarm budget"). A keyword list is a crude check; the human audit still reads every claim.

The keyword list in Lab 8 is deliberately short, so passing it proves little. A human audit should still read C4 against the T2 results: its scope is class A replay because class B evaded detection on T2, and the 18 of 20 recall belongs beside the claim, not only in the results chapter. Repeat the audit after every revision of the abstract or conclusion, and keep each run's output in the claim register's history so examiners can see how the claims narrowed.

8.2 Examiner question families

Prepare answers for: positioning ("what is new beyond Page and Giraldo?"), validity ("why should a testbed generalize?"), adversary ("what does a stronger attacker do?"), safety ("how did you bound T2 experiments?"), ethics ("what did you withhold and why?"), and impact ("what should an operator change on Monday?"). The answer to the last is architectural: provide an independently wired second measurement of key process quantities and display predicted versus reported values.

Rehearse each family aloud with a colleague who interrupts, and keep a sheet with a short answer and a pointer to the figure or table that supports it. When you do not know, say what evidence would answer the question and what you actually have. Answer the question asked, then stop.

8.3 Publication sequencing

Paper 1: the evaluation-methodology contribution (impact-at-detection and event metrics, with the TankBench-21-style reproduction lesson told generically). Paper 2: the Setpoint Study comparison with boundary conditions. Paper 3: the operator interpretability finding with human-factors collaborators. Release the T0/T1 archive with Paper 2.

Plan each paper so that it does not contradict the thesis or the other papers, and record which claims and figures each one reuses. If the operator paper is delayed by human-factors review, the other two can still appear; the archive is released with Paper 2 because that is the paper whose numbers it reproduces. Agree authorship with collaborators before writing begins.

8.4 Coordinated disclosure

If the research reveals a vulnerability in a commercial product — for example a PLC accepting unauthenticated writes to a register that should be read-only — report it to the vendor and, where appropriate, to a coordinator such as CISA's coordinated vulnerability disclosure program, agree a timeline, and publish technical detail only after mitigations are available. A design property documented in a public specification (Modbus lacking authentication) is not a vulnerability disclosure; an implementation flaw is.

Record the disclosure timeline in the thesis appendix with dates for first contact, vendor acknowledgment and publication. If the vendor does not respond, follow the coordinator's process rather than publishing early. The thesis can still describe the class of weakness while withholding product names and steps until mitigations exist.

8.5 Translation for practice

Write a two-page brief for operators with confidence levels: "High confidence (model + testbed): band alarms alone do not detect replayed level readings. Medium confidence (two contexts): an independent flow measurement plus a residual check detects single-sensor replay. No protection: if one device or PLC controls both measurements." Suggest to standards working groups that independent measurement paths be considered when assessing zone security levels — as a proposal, not as a finding of compliance.

Test the brief with one or two operators before release: can they say what to check on Monday? If they cannot, the confidence levels or the recommendation need rewording. Keep the brief consistent with the narrowed claim, and do not let a shorter format drop the case where one device controls both measurements.

8.6 Post-doctoral program

Extend to multi-loop plants, test calibrated rather than invented models, measure operator response time with real (consenting) control-room staff, and study class C attackers who modify PLC logic.

Each extension tests one boundary the thesis measured but could not cross. Multi-loop plants test whether residuals stay interpretable when loops interact. Calibrated models test whether invented parameters overstated separation. Real operators test interpretability at scale. Class C attackers, who can rewrite controller logic, test whether any invariant survives when the controller itself lies; the same safety bounds and ethics review apply to all four.

Exercises — chapter 8

Chapter synthesis

Audit every claim, prepare for the six question families, publish in an order that builds credibility, disclose implementation flaws through coordination, and translate findings with explicit confidence. The doctoral contribution is a measured method and its measured limits.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course: Critical infrastructure and sector security, doctoral (course 207) →

Worked answers

EX045. Using the EX032 or §5.5 paragraph: "detected class A replay in simulation" → PASS with scope; "robust to calibration bias" → REVISE: add scope (≤0.4 units); "works on real plants" → REVISE: overreach.

EX046. Positioning: "The CUSUM and residuals are established; our contribution is measuring delay and impact at detection for manipulation of view across two contexts and identifying the attacker capability at which the method fails." Safety: "All attacks ran in simulation or on T2 with a mechanical float valve independent of the PLC, a drip tray, a physical e-stop and a named stop authority; no production system was touched."

EX047. 1: methodology paper at a security venue (establishes metrics); 2: comparison at a control/CPS security venue (uses those metrics); 3: operator study at a human-factors venue. Order builds the vocabulary later papers depend on.

EX048. Modbus lacks authentication: documented design property, not a disclosure. PLC accepts writes to a protected register: implementation flaw → coordinated disclosure. Shared wiring on T2: lab configuration issue → tell the lab owner; not a product vulnerability.

EX049. High: band alarms alone miss replayed level readings. Medium: independent flow measurement plus residual detects single-sensor replay. Unknown: protection against an attacker controlling both measurements was not tested — do not assume it.

EX050. Year 1: multi-loop calibrated model; H: residual detection recall ≥80% with false alarms ≤1 per shift when loops couple. Year 2: consenting operator study; H: displaying predicted-versus-reported values reduces time to correct diagnosis by ≥20%. Both with frozen thresholds and refutation criteria.

End of the worked results. Return to the course chapter index.