Chapter 2 — Discrete mathematics
Lesson map
Lesson 02 published. Map, example, EX004.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Sets and relations"]
N2["2.2 Graphs and pivots"]
N3["Lab 1 — pivot graph"]
N4["2.3 Components"]
N5["Practice note — Edge weights"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX004"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Sets and relations"]
N2["2.2 Graphs and pivots"]
N3["Lab 1 — pivot graph"]
N4["2.3 Components"]
N5["Practice note — Edge weights"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX004"]
[Learning outcomes]
|
v
[2.1 Sets and relations]
|
v
[2.2 Graphs and pivots]
|
v
[Lab 1 — pivot graph]
|
v
[2.3 Components]
|
v
[Practice note — Edge weights]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX004]
Learning outcomes
You will (1) represent intelligence relationships as a graph; (2) compute reachability with breadth-first search; (3) relate graph pivots to the Diamond Model; (4) explain why disconnected components matter for attribution claims.
2.1 Sets and relations
An indicator set is a set; "event uses infrastructure" is a relation. Union, intersection and difference let engineers compare feeds; relations let them link events. STIX 2.1 expresses relations explicitly through relationship objects such as "indicates" or "uses".
Kofi compares two partner feeds by intersecting their domain sets. The overlap tells him how much the second feed adds; the difference shows what only one partner has seen. A union is what Lantern must store. Relations carry more than membership: a pair such as an indicator and the malware it indicates says how two things are connected, and the type of that link matters when an analyst later decides how far to trust it.
2.2 Graphs and pivots
Treat events, infrastructure, capabilities and victims as nodes and their links as edges. The Diamond Model of Caltagirone, Pendergast and Betz describes analytic pivoting along exactly these edges: from an event to its infrastructure, from infrastructure to other events. Breadth-first search counts hops, which is a natural limit on how far an analyst should trust a chain of inferences.
The hop count in the lab therefore doubles as a trust measure. One hop from an event is something the evidence shows directly; three hops is a chain of inferences, each of which could be wrong.
Lab 1 — pivot graph
"""Lab 1 (ch 02): breadth-first pivot over a synthetic Diamond-style relationship graph."""
from collections import deque
edges = [("event-1", "c2.example"), ("c2.example", "event-4"), ("event-4", "victim-B"),
("event-1", "victim-A"), ("event-7", "loader-x"), ("loader-x", "event-9")]
g = {}
for a, b in edges:
g.setdefault(a, set()).add(b); g.setdefault(b, set()).add(a)
def reach(start, max_hops):
seen, q = {start: 0}, deque([start])
while q:
n = q.popleft()
if seen[n] == max_hops:
continue
for m in sorted(g[n]):
if m not in seen:
seen[m] = seen[n] + 1; q.append(m)
return seen
for node, hops in sorted(reach("event-1", 3).items(), key=lambda x: (x[1], x[0])):
print(hops, node)
print("event-7 reachable:", "event-7" in reach("event-1", 10))
Run with python3 lab_graph.py. Verified output:
0 event-1
1 c2.example
1 victim-A
2 event-4
3 victim-B
event-7 reachable: False
2.3 Components
event-7 and its loader are not reachable from event-1. Two components mean no evidence in this graph links the activities. Claims that both belong to one campaign need new evidence, not wishful edges.
The lab output shows this split plainly: the search from event-1 never reaches event-7 however many hops it allows. An analyst may still suspect a connection, perhaps because the two loaders behave alike, but that suspicion belongs in the notes as a hypothesis to test. Drawing an edge without evidence would make the graph agree with the analyst and teach nobody anything. If new evidence arrives, such as a shared certificate, the edge is added with its source, and the components merge on the record.
2.4 Hop limits
Each hop adds uncertainty. Lantern caps automatic pivots at three hops and labels anything further as an analyst hypothesis.
The limit follows from simple arithmetic. If each link is right nine times in ten, a three-hop chain is right only about seven times in ten, and a five-hop chain little better than half the time. Automatic pivots beyond three hops would fill reports with links that are as likely wrong as right. An analyst can still follow a longer chain by hand, but the result is labelled as a hypothesis, and the reasoning for each extra hop is written down so a reviewer can check it.
Practice note — Edge weights
Not every edge deserves equal trust. Lantern weights an edge by specificity: a unique self-signed certificate shared by two servers is a strong link; a popular public resolver is almost none. Weighted reachability lets an analyst ask which nodes are reachable through strong edges only, which usually shrinks a dramatic campaign graph to something defensible.
Worked example
Kofi runs the pivot from event-1. Within three hops it reaches c2.example, victim-A, event-4 and victim-B. He reports that victim-B is linked to event-1 only through shared infrastructure, a three-hop chain, and recommends notifying victim-B's sector contact with that caveat.
Synthetic case. All nodes are invented.
Errors and limits
Shared infrastructure such as a large hosting provider creates false links; weight edges by specificity. Graph reachability is not attribution.
Exercises
- EX004 — Hop count. At how many hops does the lab reach victim-B? Rubric: 3 = 3; 2 = correct with no explanation of path; 1 = wrong; 0 = none.
- EX005 — Separate component. What does "event-7 reachable: False" imply for a campaign claim? Rubric: 3 = no linking evidence in graph; claim needs new evidence; 2 = partial; 1 = same campaign; 0 = none.
- EX006 — Shared hosting trap. Why might an edge through a large shared hosting IP create a false link? Rubric: 3 = many unrelated tenants share it; low specificity; 2 = vague; 1 = no issue; 0 = none.
Synthesis
Sets compare, graphs link, hops cost confidence, and disconnected components are honest silence.
Continue studying — chapter 02 of 50
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →