◇ OpenCyber Academy
Master's · Chapter 7 · English

Chapter 7 — Dissertation writing and limitations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Dissertation writing and limitations

Lesson map

Lesson 07 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Structure"]
  N2["7.2 Writing results"]
  N3["7.3 Discussion"]
  N4["7.4 Limitations"]
  N5["7.5 Overclaiming"]
  N6["7.6 Practitioner summary"]
  N7["7.7 Citation discipline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Structure"]
  N2["7.2 Writing results"]
  N3["7.3 Discussion"]
  N4["7.4 Limitations"]
  N5["7.5 Overclaiming"]
  N6["7.6 Practitioner summary"]
  N7["7.7 Citation discipline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]

[Learning outcomes]
    |
    v
[7.1 Structure]
    |
    v
[7.2 Writing results]
    |
    v
[7.3 Discussion]
    |
    v
[7.4 Limitations]
    |
    v
[7.5 Overclaiming]
    |
    v
[7.6 Practitioner summary]
    |
    v
[7.7 Citation discipline]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) structure a master's dissertation; (2) write findings without overclaiming; (3) state limitations honestly; (4) write for both examiners and practitioners.

7.1 Structure

Introduction; literature review; method; results; discussion; limitations; conclusion; appendices with scripts, coding guide and search log. This structure follows what examiners at Ridgeway University expect from a master's thesis. Keeping limitations in their own chapter makes them easy to find, rather than scattered through the discussion. The appendices let examiners check the work: scripts reproduce every number, the coding guide shows how events were classified, and the search log shows how the literature was found. Dr Osei agrees the chapter outline before Tomás drafts, so the limitations chapter is planned rather than added at the end.

7.2 Writing results

Results state what was measured, in numbers: "Mean reduction was high where the OS build preceded the reference release; designed misses were all set aside." Interpretation waits for the discussion. Keeping interpretation separate lets readers see the measured results before Tomás explains them. Each statement in the results chapter can be traced to a table and a script. He reports counts with percentages and does not use words like "safe" or "unsafe" there. Dr Osei marks any interpretation that slips into the chapter.

7.3 Discussion

Tomás links findings to practice: filtering saves review time but can hide legitimate tools used for harm. He recommends that examiners keep a "watch list" of dual-use tool hashes to pull back from the known set. The recommendation follows directly from the designed misses: since hashing cannot distinguish a legitimate tool used for harm, examiners need a separate list of such tools that are always reviewed even when they match the reference set. Tomás notes that a watch list adds review time and must be maintained, and that his study did not test it.

7.4 Limitations

Synthetic images; one file system; one reference set version; two examiners; moderate kappa; one failed image. Each limitation is paired with its likely effect on the results. For example, synthetic images contain fewer user files and less clutter than real laptops, which probably makes reduction higher than in casework. A single reference set version means results may differ with other versions. Two examiners and a moderate kappa limit how far the agreement study can be generalised. Stating each likely effect helps readers judge how much weight to give each result.

7.5 Overclaiming

He removes "filtering is safe" from a draft; the data show it is efficient with a specific, documented blind spot. The rewritten sentence describes what the data support: filtering reduced review sharply, but set aside every designed case of a legitimate tool used for harm. Tomás checks the whole thesis for similar claims and records each change in a revision log, so Dr Osei can see what was removed and why. The log also records claims he strengthened where the data allowed, such as reduction on images built before the reference release.

7.6 Practitioner summary

A one-page annex: what filtering does, what it cannot do, how to log its use in case notes, and how to report it in court statements without implying files were examined. The annex is written for examiners in units like Tomás's own, who need practical guidance rather than the whole thesis. It explains that a file set aside as known has been matched to published software, not examined, and gives example wording for case notes and statements. Dr Osei and a colleague in his unit review it before submission.

7.7 Citation discipline

Each claim about the NSRL cites NIST documentation; each claim about process cites SP 800-86 or ISO/IEC 27042; nothing cites an unchecked secondary source. This discipline matters because claims about the NSRL are easy to misstate, such as describing it as a list of good files. Tomás checks each citation against the source itself before submission, and where he could not obtain an original, he says so and does not rely on the claim. His reference list includes only sources he has read himself, which rules out repeating a review's summary of an NSRL figure.

Figures and tables

Every figure has a caption that states the data source, the number of images and the reference set version. Tables give raw counts as well as percentages, so readers can recompute any ratio. Axis labels use plain units, and colour is never the only way to distinguish series, keeping figures readable for everyone.

Worked example

A draft sentence reads: "Known-file filtering eliminates irrelevant files." Tomás rewrites: "Known-file filtering set aside files identical to published software; on 29 synthetic images this included every designed case of legitimate tools used for harm."

Synthetic case. The draft sentences are invented.

Errors and limits

A limitations section is not a confession; it tells readers where the results apply.

Exercises

Synthesis

Write numbers in results, meaning in discussion, honest limits with effects, and a practitioner annex.

Continue studying — chapter 07 of 08

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →