Chapter 11 — Supervised laboratory
Lesson map
Lesson 11 published. Map, example, EX051.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Why baselines"]
N2["11.2 Choosing a threshold"]
N3["Lab — Baseline check"]
N4["11.3 Reading the baseline"]
N5["11.4 Lab discipline"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX051"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Why baselines"]
N2["11.2 Choosing a threshold"]
N3["Lab — Baseline check"]
N4["11.3 Reading the baseline"]
N5["11.4 Lab discipline"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX051"]
[Learning outcomes]
|
v
[11.1 Why baselines]
|
v
[11.2 Choosing a threshold]
|
v
[Lab — Baseline check]
|
v
[11.3 Reading the baseline]
|
v
[11.4 Lab discipline]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX051]
Learning outcomes
You will (1) establish a baseline for denied connections; (2) detect unusual weeks; (3) investigate in a lab setting.
11.1 Why baselines
An alert threshold is easier to set if one knows what normal looks like. Grace builds a baseline of weekly denied connections at Oakline's main office from eight weeks of synthetic data. A baseline captures the usual level and its variation. Weeks far above it may signal a new device, a misconfiguration or an infection. Baselines must be rebuilt when the network changes, since a new office or service changes what normal means. Grace documents the period used so the baseline can be rebuilt consistently later.
11.2 Choosing a threshold
A common simple threshold is the mean plus two standard deviations. In roughly normal data, values above it occur by chance only a few percent of the time. Grace notes that network data may not be normal, so the threshold is a starting point to be tested against experience. She also notes that a threshold catches only sharp rises; slow increases need a trend check, which she adds to the monthly review. She records the threshold method and its date in the lab notebook before applying it.
Lab — Baseline check
"""Flag weeks whose denied-connection count is above baseline mean + 2 standard deviations (stdlib only)."""
import statistics
base = [410, 385, 430, 402, 395, 420, 415, 398]
weeks = {"W9": 405, "W10": 512, "W11": 418, "W12": 389, "W13": 470}
m, s = statistics.mean(base), statistics.stdev(base); limit = m + 2 * s
print(f"baseline mean {m:.1f} sd {s:.1f} limit {limit:.1f}")
for w, v in weeks.items(): print(f"{w:4}{v:5} {'ABOVE' if v > limit else 'normal'}")
Run with python3 lab_baseline.py. Verified output:
baseline mean 406.9 sd 14.7 limit 436.2
W9 405 normal
W10 512 ABOVE
W11 418 normal
W12 389 normal
W13 470 ABOVE
11.3 Reading the baseline
The eight baseline weeks average 406.9 denies with a standard deviation of 14.7, giving a threshold of 436.2. Weeks 10 and 13 exceed it, with 512 and 470 denies. In the lab scenario, week 10 matches the installation of new meeting room displays that tried to reach a cloud service not on the allowed list, and week 13 matches a guest who connected a laptop with malware that kept trying to reach internal addresses. Both are investigated and resolved: one by adding a needed flow, the other by guest isolation already blocking the attempts.
11.4 Lab discipline
Grace works in an isolated lab using synthetic data, documenting each step and keeping results reproducible. She writes down the threshold method before looking at the weeks, so she cannot adjust it to produce a preferred result. Sam reviews her notebook and asks her to explain why two weeks above threshold in thirteen is plausible. She explains that real events caused both, rather than chance alone. Disciplined lab work builds habits that carry into real investigations. Her notebook is kept with the lab files.
Worked example
The baseline threshold is 436.2; weeks 10 and 13 exceed it and are explained by a missing flow and a guest infection.
Synthetic case. Data and events are synthetic.
Errors and limits
Adjusting thresholds after seeing results can hide or invent anomalies.
Exercises
- EX051 — Threshold value. What threshold does the lab compute? Rubric: 3 = 436.2 from mean 406.9 plus 2 × 14.7;; 2 = 436.2;; 1 = 406.9;; 0 = none.
- EX052 — Flagged weeks. Which weeks exceed the threshold? Rubric: 3 = W10 512 and W13 470;; 2 = two;; 1 = one;; 0 = none.
- EX053 — Week 10 cause. What caused week 10's rise? Rubric: 3 = new displays reaching unlisted cloud service;; 2 = displays;; 1 = attack;; 0 = none.
- EX054 — Slow increase. How are slow increases detected? Rubric: 3 = monthly trend check;; 2 = trend;; 1 = threshold;; 0 = none.
- EX055 — Rebuild trigger. When must the baseline be rebuilt? Rubric: 3 = network changes, such as new office or service;; 2 = changes;; 1 = never;; 0 = none.
Synthesis
Baselines and simple thresholds turn raw counts into signals worth investigating.
Continue studying — chapter 11 of 12
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →