Chapter 24 — Applied research methods
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Questions from practice"]
N2["24.2 Data and method"]
N3["24.3 Measures and comparisons"]
N4["24.4 Sources"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Questions from practice"]
N2["24.2 Data and method"]
N3["24.3 Measures and comparisons"]
N4["24.4 Sources"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Questions from practice]
|
v
[24.2 Data and method]
|
v
[24.3 Measures and comparisons]
|
v
[24.4 Sources]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) frame a small applied research question from operational practice; (2) choose data and a method that fit; (3) define a measure and a comparison; and (4) find and use credible sources.
24.1 Questions from practice
Applied research at technologist level answers a question someone at the site actually has. "Does comparing logger data with PLC probes detect falsified readings faster than the cloud's own alert?" is such a question; it is specific, measurable on recorded or synthetic data, and its answer changes what NCS does.
Priya's mini-study takes that question: four synthetic weeks of anteroom data with ten injected falsifications, comparing her two-probe check with the cloud's own high-temperature alert.
The hypothesis is that falsified readings that stay within range are invisible to a threshold alert.
24.2 Data and method
Use historical data the owner provides, or synthetic data with realistic properties, and say which. A method can be as simple as replaying recorded weeks with injected falsifications and measuring how long each check takes to flag them. The method must be repeatable by someone else.
Priya's method was this replay: four synthetic weeks of anteroom readings, with ten falsifications injected at known times, run through both the two-probe comparison and the cloud's high-temperature alert. She labels the data synthetic in every table and keeps the injection script, so someone else can regenerate the same weeks.
24.3 Measures and comparisons
Choose measures before running: time to detect, false alerts per week. Compare against the current practice (the cloud alert) rather than against nothing. Report counts: "detected 9 of 10 injected falsifications; 1 false alert in 4 weeks".
Priya's result fits this pattern: the two-probe comparison with a 2 °C tolerance flagged all ten falsifications within 10 minutes; the cloud's alert flagged none, because the falsified values stayed in range. She also needs the false-alert count for the two-probe check over the four weeks, without which the comparison is incomplete. Her stated limitation is that synthetic noise is simpler than real door openings, which may cause disagreements between probes.
24.4 Sources
Use primary and peer-reviewed sources. Giraldo et al. (2018, ACM Computing Surveys, doi:10.1145/3203245) survey physics-based attack detection — the idea of checking sensor data against physical expectations, which is what comparing two independent probes does. NIST SP 800-82r3 gives programme context. Vendor blog posts are background, not evidence.
Priya's study cites Giraldo et al. to frame the two-probe check as a simple physics-based consistency test, not as proof that it works at NCS. Her evidence for that is her own four-week result.
Worked example (synthetic NCS)
Priya's mini-study uses four synthetic weeks of anteroom data with ten injected falsifications. The two-probe comparison (tolerance 2 °C) flags all ten within 10 minutes; the cloud's high-temperature alert flags none, because the falsified values stay in range. She reports the limitation: synthetic noise is simpler than real door-opening patterns.
Synthetic case — Northgate Cold Storage. Data and results are invented.
Errors and limits
Small studies support local decisions, not general claims. Do not tune the tolerance on the same injected cases you report.
Exercises
- EX070 — Turning curiosity into a question. Rewrite "are our loggers any good?" as an applied research question. Rubric: 3 = specific measure, data, comparison; 2 = two; 1 = vague; 0 = none.
- EX071 — Choosing a comparison. Why compare the two-probe check with the cloud alert rather than with "no check"? Rubric: 3 = shows improvement over current practice; realistic decision; 2 = partial; 1 = vague; 0 = none.
- EX072 — Using Giraldo et al. State how the survey relates to Priya's study. Rubric: 3 = physics-based/consistency checks frame; survey for context and methods, not proof; 2 = partial; 1 = cites as proof; 0 = none.
Synthesis
Applied research asks a real site question, measures against current practice and leans on sources that can be checked.
Continue studying — chapter 24 of 30
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →