◇ OpenCyber Academy
Engineering · Chapter 49 · English

Chapter 49 — Engineering thesis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 49 — Engineering thesis

Lesson map

Lesson 49 published. Map, example, EX145.

flowchart TD
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.2 Contributions"]
  N3["49.3 Using sources"]
  N4["49.4 Limitations"]
  N5["49.5 Future work"]
  N6["Practice note — figures"]
  N7["Writing process"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX145"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.2 Contributions"]
  N3["49.3 Using sources"]
  N4["49.4 Limitations"]
  N5["49.5 Future work"]
  N6["Practice note — figures"]
  N7["Writing process"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX145"]

[Learning outcomes]
    |
    v
[49.1 Structure]
    |
    v
[49.2 Contributions]
    |
    v
[49.3 Using sources]
    |
    v
[49.4 Limitations]
    |
    v
[49.5 Future work]
    |
    v
[Practice note — figures]
    |
    v
[Writing process]
    |
    v
[Worked example] --> [Exercise EX145]

Learning outcomes

You will (1) write an engineering thesis that reports design, implementation and evaluation; (2) situate the work in standards and literature; (3) separate contributions from context; (4) present limitations and future work precisely.

49.1 Structure

Introduction (problem, objectives, contributions); background (CTI concepts, STIX/TAXII 2.1, ATT&CK, Diamond Model, kill chain, TLP 2.0, SP 800-150); requirements; design; implementation; verification and validation; operations evidence; discussion; conclusion.

Kofi followed the structure because examiners expect it and can find what they need. The background chapter covers only what the later chapters use. The operations evidence chapter is unusual for a thesis but central here, since the claims depend on how the service behaved in practice, not only in tests. Appendices hold the full test procedures.

49.2 Contributions

Kofi's contributions: an interlocked OT vendor-watch design; a decay-model refit procedure from re-observation data; an evaluation of feed quality with labelled sets. Background material — how STIX works — is not a contribution, however long the chapter.

Kofi tested each candidate contribution by asking whether another engineer could use it without reading the rest of the thesis. The refit procedure passed: it is a short method with a worked example. A description of Lantern's database tables did not, so it moved to an appendix.

49.3 Using sources

Cite specifications for definitions, papers for models, and BEN-approved synthetic or aggregate data for results. Every claim of fact has a citation or evidence reference.

Kofi's reference list includes the specifications for STIX, TAXII and TLP, the Diamond Model paper and the kill chain paper. Results cite evidence items from the dossier by their index number. His supervisor checked a sample of citations against the sources and found one that pointed to the wrong version of a specification, which he corrected.

49.4 Limitations

Synthetic test sets, one organisation's environment, short operational period, self-reported user feedback. For each, the likely effect on conclusions.

For the synthetic test sets, the likely effect is that the measured relevance rate is higher than real advisories would produce, since the test items were written to be clear. For the short operational period, seasonal effects could not be seen. Stating these effects lets examiners judge how far the conclusions reach, and it protects Kofi from being asked to defend more than the evidence supports.

49.5 Future work

Prospective measurement of incidents prevented; cross-utility comparison with consent; automated detection of feed poisoning.

Each item is written as a question with a possible method. Measuring incidents prevented would need a comparison with similar utilities that lack the service, which requires consent from those utilities. Detecting poisoning automatically follows directly from the residual risk in the dossier and the gap the final defence admitted. Kofi lists what data each item would need, so a successor can judge whether it is feasible.

Practice note — figures

Each figure answers one question and is referenced in the text. Architecture diagrams use the same component names as the code.

Writing process

Kofi drafts results chapters first, while the evidence is fresh, then writes the introduction last so that it promises exactly what the thesis delivers. Each chapter goes to the supervisor with a cover note listing the questions he wants answered, which makes feedback faster and more focused than sending unexplained drafts.

Worked example

Kofi's supervisor marks a paragraph claiming Lantern "eliminates OT risk from vendor compromise". Kofi rewrites: "On synthetic tests, the service delivered relevant vendor alerts within 15 minutes for 96% of items; it reduces, but cannot eliminate, the time OT engineers are unaware of relevant advisories."

Synthetic case. The thesis text is invented.

Errors and limits

Overclaiming is the most common thesis defect. Confidential material from placement stays out.

Exercises

Synthesis

Structure for the reader, claim only real contributions, cite precisely, and bound conclusions with limitations.

Continue studying — chapter 49 of 50

← Chapter 48 (draft) · Course chapter index · Chapter 50 (draft) →