◇ OpenCyber Academy
Engineering · Chapter 1 · English

Chapter 1 — Calculus I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 1 — Calculus I

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The student and the company"]
  N2["1.2 Rates of change"]
  N3["1.3 Monitoring with derivatives"]
  N4["1.4 Planning storage"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The student and the company"]
  N2["1.2 Rates of change"]
  N3["1.3 Monitoring with derivatives"]
  N4["1.4 Planning storage"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 The student and the company]
    |
    v
[1.2 Rates of change]
    |
    v
[1.3 Monitoring with derivatives]
    |
    v
[1.4 Planning storage]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) use rates of change to describe security event volumes; (2) relate derivatives to log monitoring; (3) estimate log storage with an integral.

1.1 The student and the company

Lindiwe Dube begins a five-year engineering course at the fictional Brightwater Polytechnic, supervised by Prof. Marcus Hale. Her placement partner is the fictional Saltmarsh Logistics, which employs about 1,800 people across twelve depots and runs roughly 2,400 networked devices, including 300 servers. Information security at Saltmarsh means protecting the confidentiality, integrity and availability of shipment, customer and payroll data. Prof. Hale explains that every mathematics course will connect to a real security decision at Saltmarsh, so theory is always tested against a working system. She starts in September.

1.2 Rates of change

Calculus starts with rates. If the number of stored security log events is a function of time, its derivative tells Saltmarsh how fast log storage grows. Lindiwe estimates that servers, firewalls and laptops together produce about forty million events per day, a steady rate. When Saltmarsh opens a new depot, the rate itself rises, so the second derivative becomes positive. She learns that planning log retention must use the growth rate, because a plan based only on today's total will run out of space early.

1.3 Monitoring with derivatives

Lindiwe applies the idea to monitoring. A sudden fall in the rate of incoming events from one depot, a large negative derivative, may mean a log forwarder has stopped, not that the depot became quieter. Attackers sometimes disable logging deliberately, so a silent source is itself a security signal. She proposes computing hourly event rates per source and alerting when a rate drops sharply. Prof. Hale notes that this turns a mathematical idea into a detective control for missing evidence. The depot team agrees.

1.4 Planning storage

Saltmarsh's policy keeps security logs for one year online and longer in archive. Lindiwe integrates the event rate over a year, allowing for two new depots, and finds the total grows faster than a simple multiple of today's volume. Prof. Hale asks her to compare full retention with keeping only summarised authentication and firewall events after ninety days. The integral shows large savings, but she notes that summaries can remove detail an investigator later needs, so retention is both a cost and an evidence decision.

Worked example

Lindiwe models log growth as a rate, uses sudden rate drops to detect silent sources and integrates over a year to compare full and summarised retention.

Synthetic case. Brightwater, Saltmarsh and all people are synthetic.

Errors and limits

Treating a quiet log source as safe can hide a disabled forwarder.

Exercises

Continue studying — lesson 01 (chapter 01 of 50)

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.