Chapter 7 — Probability and statistics

Chapter 7 — Probability and statistics

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Probability models"]
  N2["7.2 Estimates and intervals"]
  N3["7.3 Anomaly or noise"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Probability models"]
  N2["7.2 Estimates and intervals"]
  N3["7.3 Anomaly or noise"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Probability models]
    |
    v
[7.2 Estimates and intervals]
    |
    v
[7.3 Anomaly or noise]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) model uncertain events; (2) estimate rates and intervals; (3) distinguish anomalies from noise.

7.1 Probability models

Many security questions are probabilistic. Jonas models meter faults as rare independent events and uses the Poisson distribution to estimate how many faulty readings to expect each month among 400 meters. With a historical fault rate of one per thousand meter-days, he expects about twelve per month. Observing twenty in one month is unusual but possible; observing sixty would strongly suggest a systematic problem, such as a firmware update gone wrong. Probability turns gut feelings about whether something is odd into quantified statements.

7.2 Estimates and intervals

Point estimates hide uncertainty. Jonas learns to report intervals: from a pilot of fifty households over three months, the rate of disputed credit records is estimated with a 95 percent interval rather than a single figure. The interval is wide because the sample is small, which tells the board that more data are needed before setting service targets. Reporting uncertainty honestly prevents decisions based on false precision, a lesson that recurs in measurement and validation chapters later. He reports the interval alongside every estimate.

7.3 Anomaly or noise

Monitoring must separate genuine anomalies from normal variation. Jonas compares a fixed threshold, such as more than two thousand credits minted in an hour, with a statistical one based on the mean and spread of past hours. The statistical threshold adapts to seasons but can be slowly shifted by gradual misuse; the fixed one is simple but must be reviewed. He recommends using both, with the physical capacity bound from chapter one as a hard limit, so that each method covers the other's weakness.

Worked example

Jonas expects about 12 meter faults per month at one per thousand meter-days, reports a wide interval for dispute rates, and recommends combined fixed and statistical thresholds.

Synthetic case. Rates, meters and thresholds are synthetic.

Errors and limits

Reporting a single estimate from a small pilot hides how uncertain it is.

Exercises

• EX019 — Expected faults. How many faults per month does Jonas expect? Rubric: 3 = about twelve;; 2 = 12;; 1 = 400;; 0 = none.
• EX020 — Wide interval. Why is the dispute-rate interval wide? Rubric: 3 = small pilot sample;; 2 = few data;; 1 = error;; 0 = none.
• EX021 — Combined thresholds. Why use both fixed and statistical thresholds? Rubric: 3 = each covers the other's weakness;; 2 = complementary;; 1 = cheaper;; 0 = none.

Synthesis

Probability models, intervals and combined thresholds help separate real anomalies from noise.

Continue studying — chapter 07 of 50

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →