Chapter 7 — Dissertation writing and limitations
Lesson map
Lesson 07 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Structure"]
N2["7.2 Writing results"]
N3["7.3 The discussion"]
N4["7.4 Limitations"]
N5["7.5 Recommendations"]
N6["7.6 Proportion"]
N7["7.7 Writing process"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Structure"]
N2["7.2 Writing results"]
N3["7.3 The discussion"]
N4["7.4 Limitations"]
N5["7.5 Recommendations"]
N6["7.6 Proportion"]
N7["7.7 Writing process"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]
[Learning outcomes]
|
v
[7.1 Structure]
|
v
[7.2 Writing results]
|
v
[7.3 The discussion]
|
v
[7.4 Limitations]
|
v
[7.5 Recommendations]
|
v
[7.6 Proportion]
|
v
[7.7 Writing process]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) structure a master's dissertation; (2) write results without overclaiming; (3) write a strong limitations section; (4) make recommendations proportional to evidence.
7.1 Structure
Abstract; introduction; literature review; method; results; discussion; limitations; recommendations; conclusion; references; appendices (protocol, scripts, allow-list change log).
The allow-list change log in the appendices matters most to practitioners: it shows each entry's original and narrowed form with dates and reasons, including AL-07. The scripts let a reader reproduce the difference-in-differences and the stratified sample from the archived counts. Putting recommendations in their own chapter, after the limitations, means every recommendation is read in the light of what the study could not show.
7.2 Writing results
Results report what was measured with uncertainty: "Net reduction of 136.5 alerts per week (bootstrap 95% interval 98–171)." Interpretation belongs in the discussion. Tariq avoids words such as "proves" and "eliminates".
The interval matters as much as the estimate: 98 to 171 alerts a week tells Pelham's managers that the saving is real but uncertain in size. Keeping interpretation out of the results chapter means a reader can check the numbers against the scripts before reading what Tariq thinks they mean. The plain summary for Pelham uses the same interval, so managers and examiners see the same uncertainty.
7.3 The discussion
Tuning removed mostly benign triggers, consistent with Alahmadi et al. (2022). The suppressed injected event shows allow-lists move risk rather than removing it: they trade analyst time against blind spots. Narrow, conditional entries reduce the trade-off.
The discussion links back to the seminar claim: volume reduction alone would have hidden the AL-07 problem. It also explains why narrow entries help: a condition such as a signed naming pattern and a maintenance window removes routine noise while leaving misuse of the same account visible.
7.4 Limitations
One SOC; eight weeks; twenty rules; eight injected events; labelling by two people from the same team; parallel-trends assumption untestable after week 5; purple-team behaviours chosen by people who knew the rules. Each limitation states its likely direction of bias where possible — for example, injected events designed with knowledge of rule logic probably make suppression look rarer than it would be against unknown attackers.
The labelling limit is written out in full in the dissertation: both labellers share assumptions about what is normal, so shared bias would not show up as disagreement, and an external labeller would strengthen future work.
7.5 Recommendations
Review allow-list entries with the same rigour as rules; add conditions (time window, signed names) rather than broad host-account pairs; replay entries against purple-team events quarterly; track suppressed-attack tests as a metric beside volume.
Each recommendation comes from a specific finding. Reviewing entries like rules follows from the AL-07 case. Conditions instead of host-account pairs follow from how the narrowing fixed it. Quarterly replay follows from the fact that the problem was only visible with injected events. Tracking suppressed-attack tests beside volume follows from the seminar argument that volume alone rewards silence.
7.6 Proportion
Recommendations are framed for SOCs similar to Pelham's, not "all SOCs".
That boundary follows from the study: one SOC, twenty rules and eight injected events cannot show what happens in a SOC with different tools, staff or change processes. When the external reviewer pointed out that smaller SOCs may lack a mature change process, Tariq added a paragraph saying how the recommendations scale down, rather than widening the claim. The scaled version keeps the core steps, conditional entries and replay against simulated events, and drops the formal change board that only a larger SOC like Pelham's can staff.
7.7 Writing process
Tariq writes the method first, results second, discussion last, and sends each chapter to Solberg as it is finished.
Writing the method first, while the design is fresh, means it describes what was actually done, including the export script and the narrowing of AL-07. Sending each chapter as it is finished lets Solberg catch problems early, such as a results sentence that drifts into interpretation, rather than in a final read when changes are expensive. Her comments on the method chapter can still change how results are reported, which would be impossible if all chapters arrived together at the end.
Worked example
Tariq's limitation paragraph on labelling: "Both labellers work in the Pelham SOC and may share assumptions about what is normal. Agreement after definition changes was high, but shared bias would not appear as disagreement. An external labeller would strengthen future work."
Synthetic case. The text is invented.
Errors and limits
Long limitation lists without direction or impact are less useful than a few analysed ones.
Exercises
- EX039 — Dissertation parts. List the main dissertation sections in order. Rubric: 3 = abstract through appendices in order; 2 = minor slips; 1 = jumbled; 0 = none.
- EX040 — Results wording. Rewrite "tuning eliminated noise" in results style. Rubric: 3 = measured estimate with interval, no overclaim; 2 = partial; 1 = unchanged; 0 = none.
- EX041 — Risk trade. What trade-off does the discussion identify? Rubric: 3 = analyst time vs blind spots; narrow entries reduce it; 2 = partial; 1 = vague; 0 = none.
- EX042 — Bias direction. Which way does purple-team design bias the suppression estimate? Rubric: 3 = makes suppression look rarer; designers knew rules; 2 = direction only; 1 = wrong; 0 = none.
- EX043 — Recommendations. Give three recommendations. Rubric: 3 = review entries rigorously, conditional entries, quarterly replay, suppression metric (three); 2 = two; 1 = one; 0 = none.
- EX044 — Shared bias. Why would shared labeller bias not show up as disagreement? Rubric: 3 = both share the same assumptions so they agree wrongly; 2 = partial; 1 = it would; 0 = none.
Synthesis
Report measured results plainly, interpret in discussion, analyse limitations with their direction and keep recommendations proportional.
Continue studying — chapter 07 of 08
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →