◇ OpenCyber Academy
Engineering · Chapter 42 · English

Chapter 42 — Network and communications security: applied research

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 42 — Network and communications security: applied research

Lesson map

Lesson 42 published. Map, example, EX124.

flowchart TD
  N0["Learning outcomes"]
  N1["42.1 Question"]
  N2["42.2 Data"]
  N3["42.3 Analysis"]
  N4["42.4 Literature"]
  N5["Method and threats to validity"]
  N6["From finding to practice"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX124"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["42.1 Question"]
  N2["42.2 Data"]
  N3["42.3 Analysis"]
  N4["42.4 Literature"]
  N5["Method and threats to validity"]
  N6["From finding to practice"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX124"]

[Learning outcomes]
    |
    v
[42.1 Question]
    |
    v
[42.2 Data]
    |
    v
[42.3 Analysis]
    |
    v
[42.4 Literature]
    |
    v
[Method and threats to validity]
    |
    v
[From finding to practice]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX124]

Learning outcomes

You will (1) frame a research question from the project; (2) analyse data; (3) relate to literature.

42.1 Question

Kofi frames a research question that comes directly from operating the network: do unexpected denies in the first weeks after an office migrates predict later service complaints from that office? If they do, engineers could use deny counts as an early warning and prioritise which offices to visit or call. A good applied question is narrow enough to answer with available data, useful to the partner if answered either way, and stated before the data are examined, so that the analysis tests the question rather than searching for any pattern that happens to appear.

42.2 Data

The data are weekly counts of unexpected denies per office and service desk tickets mentioning network access, both covering eight migrations. Before analysis, office names and any staff identifiers are replaced with codes, and only counts leave the council's systems, which the information governance officer approves. Kofi also records each office's staff numbers, migration date and season, because these may explain differences. Using data the council already collects for operations avoids new monitoring of staff, which keeps the study proportionate and simplifies its ethical review.

42.3 Analysis

Kofi plots first-week unexpected denies against tickets in the first two weeks for each office. Offices with more denies tend to have more tickets, a positive association. Because larger offices could simply have more of both, he repeats the comparison per hundred staff, and the pattern weakens but remains. With only eight offices, a single unusual office could create or hide the pattern, so he reports the direction and size of the association without a strong statistical claim, describing it as suggestive and worth testing on more data rather than established.

42.4 Literature

He places the finding in context. Wool's 2004 study of firewall rule sets showed that configuration errors are common and grow with complexity, which supports the idea that newly introduced policies will contain gaps that surface as unexpected denies. Sommer and Paxson's 2010 paper on machine learning for intrusion detection warns how hard it is to generalise from limited operational data, which supports his caution. Linking a small local result to established work shows readers where it fits and stops it from being presented as more novel or more general than it is.

Method and threats to validity

Kofi writes a short method section. He defines an unexpected deny as a denied flow in an allowed business category that was not on the expected list, and a service complaint as a ticket mentioning network access. Both definitions are fixed before he looks at the results. He then lists threats to validity. Offices differ in size, so larger offices may simply have more of both; he therefore also compares counts per hundred staff. Ticket wording varies, so some complaints may be missed. Migrations happened in different seasons, which could affect workload. Naming these threats helps readers judge the finding fairly rather than overstating it.

From finding to practice

Even a suggestive result can inform practice when acting on it is cheap. Kofi recommends that, for future migrations, engineers review unexpected denies daily in the first week and contact the office manager when the count exceeds a simple threshold. The cost is a few minutes a day, and the possible benefit is fewer frustrated staff and faster discovery of missing flows. He also suggests that if the council or neighbouring councils carry out more migrations, they record the same two measures so a larger dataset can test the association properly. This turns a small study into the start of a continuing evidence base.

Worked example

The analysis is written as a two-page note for the council and a section of the thesis.

Synthetic case. Data are synthetic.

Errors and limits

Eight data points cannot support strong claims.

Exercises

Synthesis

Applied research turns project data into modest, useful evidence.

Continue studying — chapter 42 of 50

← Chapter 41 (draft) · Course chapter index · Chapter 43 (draft) →