Chapter 7 — Probability and statistics
Lesson map
Lesson 07 published. Map, example, EX013.
flowchart TD
N0["Learning outcomes and connection"]
N1["7.1 Probability as a model of uncertainty"]
N2["7.2 Bayes' rule and the base-rate problem"]
N3["7.3 Redundancy and common cause"]
N4["7.4 Rare events: the Poisson model"]
N5["7.5 Describing data honestly"]
N6["7.7 Practical activity: Lab 4"]
N7["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX013"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["7.1 Probability as a model of uncertainty"]
N2["7.2 Bayes' rule and the base-rate problem"]
N3["7.3 Redundancy and common cause"]
N4["7.4 Rare events: the Poisson model"]
N5["7.5 Describing data honestly"]
N6["7.7 Practical activity: Lab 4"]
N7["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]
[Learning outcomes and connection]
|
v
[7.1 Probability as a model of uncertainty]
|
v
[7.2 Bayes' rule and the base-rate problem]
|
v
[7.3 Redundancy and common cause]
|
v
[7.4 Rare events: the Poisson model]
|
v
[7.5 Describing data honestly]
|
v
[7.7 Practical activity: Lab 4]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX013]
Learning outcomes and connection
After this chapter you can (1) apply Bayes' rule to alarms and explain the base-rate problem; (2) compute availability of redundant paths with and without common-cause failure; (3) model rare events with the Poisson distribution; and (4) summarise data with honest uncertainty, including when to distrust a small sample. It builds on Chapters 1–6 and prepares Chapters 23 (failure analysis), 29 (measurement) and 32 (reliability).
7.1 Probability as a model of uncertainty
A probability is a number between 0 and 1 attached to an event under a model. Engineers use three readings: long-run frequency (pump failures per year across a fleet), degree of belief (an expert's estimate of an adversary's capability), and design allowance (a target such as 99.9% availability). Be explicit about which you mean; mixing them is how risk registers become fiction. The core rules: $P(A \cup B) = P(A) + P(B) - P(A\cap B)$; $P(A \cap B) = P(A)P(B\mid A)$; independence means $P(B\mid A) = P(B)$.
7.2 Bayes' rule and the base-rate problem
$P(H\mid E) = P(E\mid H)P(H)/P(E)$. Apply it to an intrusion alarm: let attacks occur in 0.1% of hourly windows, the detector fire on 95% of attacks (true-positive rate) and on 1% of benign windows (false-positive rate). The probability that an alarm means an attack is only about 8.7%. Most alarms are false even for a "99% accurate" detector, because benign windows vastly outnumber attacks. This is why operators learn to ignore alarms — and why alarm design must report the expected alarm rate and the positive predictive value, not only accuracy. Sommer and Paxson (2010) discuss this and related obstacles to anomaly detection in operational networks.
7.3 Redundancy and common cause
If one communications path is available with probability $a$ and paths fail independently, $n$ paths give $1-(1-a)^n$. Independence is the assumption that fails in practice: paths sharing a power feeder, a vendor, a configuration or an exploitable vulnerability fail together. The beta-factor model assigns a fraction $\beta$ of each unit's unavailability to common causes that defeat all units at once. With $a = 0.98$ and $\beta = 0.05$, two paths have unavailability ≈ 0.00136 instead of 0.0004: common cause dominates. In security, an identical software vulnerability in both paths is a common cause with $\beta$ close to 1 against an adversary who knows it.
7.4 Rare events: the Poisson model
If events arrive independently at average rate $\lambda$ per year, the number in a year is Poisson: $P(N=k) = e^{-\lambda}\lambda^k/k!$. With $\lambda = 0.5$ long grid outages per year, $P(N \ge 1) \approx 0.39$. Poisson assumes a constant rate and independence; storms, campaigns of attacks and ageing violate both, so treat it as a first approximation.
For LRWA, a long grid outage of more than four hours is the event that tests R5 and the hospital buffer together. If outages cluster in storms, the Poisson figure understates the chance of two outages within days, so the TMRP team checks it against the distributor's outage records before using it in the fault tree.
7.5 Describing data honestly
Report a central value with spread (median and interquartile range for skewed data such as outage durations), the sample size, and how the data were collected. A confidence interval describes sampling uncertainty under a model; it says nothing about bias in what was recorded. Small samples of rare events are especially treacherous: zero failures in 3 years of operation does not mean zero risk. The "rule of three" gives an approximate 95% upper bound of $3/n$ on a rate when 0 events are observed in $n$ trials or time units.
7.6 Worked example: should LRWA page the on-call engineer? (synthetic)
The TMRP proposes a network anomaly detector at the control centre with the rates in §7.2. Evaluated over hourly windows, it would page about 0.26 times a day — roughly once every four days — and about 91% of pages would be false. The team decides: page only when the network alarm coincides with a process anomaly (unexpected setpoint change or flow imbalance), and route lone network alarms to a next-business-day review queue. The decision is justified by the base rate, and its cost — slower response to a stealthy network-only attack — is recorded in the risk register.
7.7 Practical activity: Lab 4
# Lab 4 - base rates, redundancy and rare events (synthetic numbers, offline)
import math
prior, tpr, fpr = 0.001, 0.95, 0.01
ppv = tpr * prior / (tpr * prior + fpr * (1 - prior))
print(f"P(attack | alarm) = {ppv:.3f}")
alarms_per_day = 24 * (tpr * prior + fpr * (1 - prior))
print(f"expected alarms per day (hourly windows) = {alarms_per_day:.3f}")
a = 0.98
for n in (1, 2, 3): print(f"{n} independent paths at {a}: availability {1 - (1 - a) ** n:.6f}")
beta = 0.05 # beta-factor common-cause share of unavailability
q = 1 - a
print(f"2 paths with beta={beta}: unavailability {(1 - beta) ** 2 * q ** 2 + beta * q:.6f}")
lam = 0.5
print(f"P(>=1 grid outage >4 h per year | lambda={lam}) = {1 - math.exp(-lam):.3f}")
print(f"P(>=2) = {1 - math.exp(-lam) * (1 + lam):.4f}")
Expected output:
P(attack | alarm) = 0.087
expected alarms per day (hourly windows) = 0.263
1 independent paths at 0.98: availability 0.980000
2 independent paths at 0.98: availability 0.999600
3 independent paths at 0.98: availability 0.999992
2 paths with beta=0.05: unavailability 0.001361
P(>=1 grid outage >4 h per year | lambda=0.5) = 0.393
P(>=2) = 0.0902
The first two lines repeat the base-rate result from the worked example: fewer than one alarm in ten would be a real attack, and the detector would page about once every four days. The redundancy lines show how quickly independent paths improve availability, and the beta-factor line shows how a five per cent common cause wipes out most of that gain. The Poisson lines give the chance of at least one, and at least two, long grid outages in a year at LRWA's assumed rate.
7.8 Common errors and limits
- Reporting detector accuracy without the base rate and predictive value.
- Multiplying availabilities as if independent when paths share causes.
- Using Poisson for clustered events.
- Treating zero observed failures as zero probability.
- Point estimates without sample size and collection method.
Each error has an LRWA example. Paging the on-call engineer for every network alarm ignores the base rate. Treating the two LTE paths as independent ignores their shared feeder. Using Poisson for storm outages hides clustering, and three quiet years at PS4 do not prove the pumps cannot fail together.
Exercises — chapter 7
EX013 — Base rate sensitivity. Objective: see how predictive value depends on prevalence. Inputs: Lab 4. Steps: compute PPV for priors 0.0001, 0.001 and 0.01 with the same detector, and for prior 0.001 with FPR 0.001. Expected evidence: four values and a recommendation on which parameter to improve. Rubric: 3 = correct values and the insight that FPR reduction matters most at low prevalence; 2 = values right; 1 = one value; 0 = none.
EX014 — Common cause in telemetry. Objective: quantify diversity. Inputs: two LTE paths from different carriers ($a = 0.98$ each). Steps: compute unavailability for $\beta$ = 0, 0.05, 0.2; name two real common causes these paths might still share. Expected evidence: three numbers and two causes. Rubric: 3 = correct numbers and plausible shared causes (site power, shared tower or backhaul, same modem firmware); 2 = generic causes; 1 = one number; 0 = none.
Chapter synthesis
Probability is a model; say which kind. Bayes' rule makes base rates decisive for alarms; redundancy works only to the extent that failures are independent, and common causes — including shared vulnerabilities — usually dominate. Poisson is a starting point for rare events. Describe data with spread, sample size and collection method, and never treat absence of observed failures as proof of safety.
Continue studying — chapter 07 of 50
← Chapter 06 · Course chapter index · Chapter 08 →
Continue to the next authored lesson.