Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX033.
flowchart TD
N0["Learning outcomes and connection"]
N1["17.1 Response as feedback"]
N2["17.2 Delay, noise and oscillation"]
N3["17.3 Stabilising techniques"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX033"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["17.1 Response as feedback"]
N2["17.2 Delay, noise and oscillation"]
N3["17.3 Stabilising techniques"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX033"]
[Learning outcomes and connection]
|
v
[17.1 Response as feedback]
|
v
[17.2 Delay, noise and oscillation]
|
v
[17.3 Stabilising techniques]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX033]
Learning outcomes and connection
After this chapter you can (1) describe an alert-to-containment pipeline as a feedback loop with sensor, controller and actuator; (2) explain how delay and noise cause oscillation or missed action; (3) use thresholds with hysteresis and rate limits to stabilise automated response; and (4) place a human gate and a stability measure in the loop. It builds on Chapters 1 and 6 and prepares Chapters 27, 31 and 33.
17.1 Response as feedback
A feedback loop measures a system, compares the measurement with a goal and acts to reduce the difference. In automated response, the sensor is detection (a risk score per host or account), the controller is policy (isolate if score exceeds a threshold), the actuator is containment, and the plant is the organisation's IT estate — including users who react to being isolated. Åström and Murray's Feedback Systems is a freely available introduction to the theory.
17.2 Delay, noise and oscillation
Detection delay means the controller acts on old information. Noisy scores near a single threshold cause chattering: isolate, release, isolate again — each toggle disrupts users and erodes trust in the system. Isolation also changes the signal itself (an isolated host stops sending telemetry, so its score drops, so it is released): the action feeds back into the measurement. Observability suffers: a loop that acts can destroy the evidence it needs to judge whether it acted correctly. Lab 17 shows chattering with a single 0.45 threshold, which produces 9–10 toggles.
17.3 Stabilising techniques
Hysteresis uses two thresholds: act above $\theta_{on}$, release only below $\theta_{off} < \theta_{on}$. Dwell time requires the condition to persist for $k$ samples. Rate limits cap actions per period. Human gates require approval for actions beyond a scope. Stability measure: toggles per incident or per day, tracked as a service metric with a threshold.
Lab 17 measures the first and last of these techniques directly. With hysteresis between 0.55 and 0.35, toggles fall from 9 to 2 while first isolation stays at step 23. HVSS then added the human gate for servers and patient-facing services, plus a four-hour expiry for automatic workstation isolations.
17.4 Worked example (synthetic): HVSS auto-isolation loop
Lab 17 simulates 60 steps of a host risk score with noise (σ = 0.18); a true attack raises the mean from 0.25 to 0.6 during steps 20–34.
"""Lab 17 (synthetic): automated alert-to-containment loop with delay; threshold and hysteresis."""
import random
def run(threshold, release, delay, seed=7, steps=60):
rng = random.Random(seed); isolated = False; toggles = 0; hist = []; first = None; iso_steps = 0; false_iso = 0
for t in range(steps):
true_risk = 0.6 if 20 <= t < 35 else 0.25
hist.append(true_risk + rng.gauss(0, 0.18))
seen = hist[t - delay] if t >= delay else 0.0
if not isolated and seen > threshold:
isolated, toggles = True, toggles + 1
if first is None and t >= 20: first = t
elif isolated and seen < release: isolated, toggles = False, toggles + 1
if isolated:
iso_steps += 1
if not (20 <= t < 35): false_iso += 1
return toggles, first, iso_steps, false_iso
print("attack window: steps 20-34 (15 steps)")
for th, rel, d in [(0.45, 0.45, 0), (0.45, 0.45, 3), (0.55, 0.35, 3), (0.75, 0.35, 3)]:
tg, first, iso, fi = run(th, rel, d)
print(f"on>{th:.2f} off<{rel:.2f} delay {d}: toggles={tg:2d} first-isolation-in-window={first} isolated-steps={iso} outside-window={fi}")
Expected output:
attack window: steps 20-34 (15 steps)
on>0.45 off<0.45 delay 0: toggles=10 first-isolation-in-window=20 isolated-steps=19 outside-window=4
on>0.45 off<0.45 delay 3: toggles= 9 first-isolation-in-window=23 isolated-steps=19 outside-window=7
on>0.55 off<0.35 delay 3: toggles= 2 first-isolation-in-window=23 isolated-steps=15 outside-window=3
on>0.75 off<0.35 delay 3: toggles= 2 first-isolation-in-window=30 isolated-steps=8 outside-window=3
A single threshold of 0.45 chatters (9–10 toggles) and isolates outside the attack window. Adding a three-step delay does not reduce chattering and delays first isolation to step 23. Hysteresis (on above 0.55, off below 0.35) reduces toggles to 2 with the same first-isolation time. Raising the on-threshold to 0.75 delays isolation to step 30, halfway through the attack: stability bought with responsiveness. In every configuration there are isolated steps outside the window — false isolations — which is why HVSS placed a human gate on any isolation of servers or patient-facing services, and allowed automatic action only for workstations with hysteresis, a four-hour automatic expiry and a toggle-rate alarm.
17.5 Errors and limits
- One threshold on a noisy signal.
- Ignoring that actions change the measured signal.
- Measuring only detection speed, not toggles and false actions.
- Automating actions whose harm is not bounded.
The four Lab 17 runs illustrate the first and third errors together. Judged only by first isolation, the single 0.45 threshold without delay looks best at step 20, yet it toggles ten times and isolates four steps outside the attack window. A report that lists toggles and outside-window isolations beside detection speed makes the hysteresis configuration the defensible choice.
Exercises — chapter 17
EX033 — Tune. Objective: explore the trade-off. Inputs: Lab 17. Steps: run (on 0.60, off 0.35, delay 3) and (on 0.55, off 0.45, delay 3); report toggles, first isolation and outside-window steps; choose one and justify. Expected evidence: outputs and justification. Rubric: 3 = correct runs and justified choice referencing harm; 2 = runs only; 1 = attempt; 0 = none.
EX034 — Human gate placement. Objective: design the loop. Inputs: host classes: workstations, servers, patient-facing systems. Steps: specify for each class whether action is automatic, gated or forbidden, with thresholds, expiry and stability metric. Expected evidence: table. Rubric: 3 = differentiated by harm with stability metric and expiry; 2 = partial; 1 = uniform; 0 = none.
Chapter synthesis
Automated response is a feedback loop. Delay, noise and self-influence cause chattering and blind spots; hysteresis, dwell, rate limits, expiry and human gates — measured by a stability metric — keep the loop safe.
Continue studying — chapter 17 of 50
← Chapter 16 · Course chapter index · Chapter 18 →
Continue to the next authored lesson.