Chapter 9 — Programming II
Lesson map
Lesson 09 published. Map, example, EX025.
flowchart TD
N0["Learning outcomes"]
N1["9.1 A triage program"]
N2["Lab — Grouping duplicate reports and timing the firs"]
N3["9.2 Data structures"]
N4["9.3 Privacy in processing"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX025"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 A triage program"]
N2["Lab — Grouping duplicate reports and timing the firs"]
N3["9.2 Data structures"]
N4["9.3 Privacy in processing"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX025"]
[Learning outcomes]
|
v
[9.1 A triage program]
|
v
[Lab — Grouping duplicate reports and timing the firs]
|
v
[9.2 Data structures]
|
v
[9.3 Privacy in processing]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX025]
Learning outcomes
You will (1) structure a program that processes reported emails; (2) design data structures for triage; (3) protect privacy in automated processing.
9.1 A triage program
Greyford's security team receives many reported emails. Aiko writes a program that groups reports of the same email, counts how many staff reported each and records the time of the first report. Grouping reduces the team's workload, because twenty reports of one phishing email need one investigation. She structures the program with small functions for reading, grouping and summarising, each tested separately, so later changes are safer. She writes a short test for each function using small hand-made report lists, so that any later change that breaks grouping or timing is noticed immediately rather than discovered during a real incident.
Lab — Grouping duplicate reports and timing the first report
# Group duplicate reported emails and find first-report delay (synthetic; minutes after arrival).
reports = [("payroll@greyf0rd.co", "Update your bank details", m) for m in (9, 11, 12, 14, 15, 18, 20, 22, 25, 30, 33, 40, 41, 45)] + \
[("it-help@vendorx.io", "Mailbox full", m) for m in (25, 31, 38, 47, 52, 60, 66, 70, 75)] + \
[("news@supplier.example", "Monthly newsletter", m) for m in (120, 180, 200)] + \
[("dhl-track@parcel.example", "Missed delivery", m) for m in (16, 19, 27, 29, 35, 44, 48)] + \
[("ceo.greyford@gmail.example", "Quick favour", m) for m in (14, 17, 26, 39, 55)] + \
[("hr@greyford.example", "Benefits survey", m) for m in (90, 95)]
groups = {}
for sender, subject, m in reports:
key = (sender, subject.lower()); c, first = groups.get(key, (0, 10**9)); groups[key] = (c + 1, min(first, m))
print(f"{len(reports)} reports -> {len(groups)} distinct emails")
for (s, subj), (c, first) in sorted(groups.items(), key=lambda x: -x[1][0]):
print(f"{c:3d} reports, first after {first:3d} min: {subj} <{s}>")
Run with python3 lab_triage.py. Verified output:
40 reports -> 6 distinct emails
14 reports, first after 9 min: update your bank details <payroll@greyf0rd.co>
9 reports, first after 25 min: mailbox full <it-help@vendorx.io>
7 reports, first after 16 min: missed delivery <dhl-track@parcel.example>
5 reports, first after 14 min: quick favour <ceo.greyford@gmail.example>
3 reports, first after 120 min: monthly newsletter <news@supplier.example>
2 reports, first after 90 min: benefits survey <hr@greyford.example>
9.2 Data structures
Aiko uses a dictionary keyed by a fingerprint of each email's sender and subject. Each entry stores the count and the earliest report time. This structure makes grouping fast even with thousands of reports. The lab shows that forty reports reduce to six distinct emails, and the most reported email was first reported nine minutes after arrival. That first-report time is the key figure for exposure, linking back to her calculus model in chapter 1. She notes that a mistyped sender could split one campaign into two groups, and adds a manual merge option.
9.3 Privacy in processing
Reported emails may contain personal information. Aiko's program stores only sender, subject fingerprint and report times, not message bodies or reporter names. The security team can open the original email in a controlled tool when needed. She documents what the program stores and why. Minimising stored data in automated tools reduces risk if the tool's database is ever exposed, and it reassures staff that reporting does not expose their own mail. She shares the stored-field list with staff representatives, who welcome it and agree to mention it when promoting the report button.
Worked example
Aiko writes a tested triage program that groups duplicate reports with a dictionary, finds the first-report time and stores minimal data.
Synthetic case. Reports are synthetic.
Errors and limits
Fingerprints can split variants of one campaign. Minimal storage may limit later investigations.
Exercises
- EX025 — Grouping benefit. Why group duplicate reports? Rubric: 3 = many reports of one email need only one investigation;; 2 = workload;; 1 = vague;; 0 = none.
- EX026 — Lab grouping. How many distinct emails did forty reports reduce to in the lab? Rubric: 3 = six, the top one first reported after 9 minutes;; 2 = six;; 1 = forty;; 0 = none.
- EX027 — Stored fields. What does the triage program store? Rubric: 3 = sender, subject fingerprint and report times only;; 2 = minimal;; 1 = bodies;; 0 = none.
Synthesis
Well-structured triage code reduces workload and measures exposure while storing only what it needs.
Continue studying — chapter 09 of 50
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →