Research Methods for Cyber Security

Thomas W. Edgar, David O. Manz

• Publisher: Syngress
• Year: 2017
• ISBN:
  9780128129302
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Research Methods for Cyber Security teaches scientific methods for generating impactful knowledge, validating theories, and adding critical rigor to the cyber security field. This book shows how to develop a research plan, beginning by starting research with a question, then offers an introduction to the broad range of useful research methods for cyber security research: observational, mathematical, experimental, and applied. Each research method chapter concludes with recommended outlines and suggested templates for submission to peer reviewed venues. This book concludes with information on cross-cutting issues within cyber security research.

Cyber security research contends with numerous unique issues, such as an extremely fast environment evolution, adversarial behavior, and the merging of natural and social science phenomena. Research Methods for Cyber Security addresses these concerns and much more by teaching readers not only the process of science in the context of cyber security research, but providing assistance in execution of research as well.

• Presents research methods from a cyber security science perspective
• Catalyzes the rigorous research necessary to propel the cyber security field forward
• Provides a guided method selection for the type of research being conducted, presented in the context of real-world usage

Part I

Introduction

Outline

Part I. Introduction

Chapter 1 Introduction to Science

Chapter 2 Science and Cyber Security

Chapter 3 Starting Your Research

Part I. Introduction

To raise new questions, new possibilities, to regard old problems from a new angle, requires creative imagination and marks real advance in science.

Albert Einstein

Chapter 1

Introduction to Science

Abstract

This chapter aims to introduce science and the way it has been used to help our understanding of the universe and everything in it, as well as to achieve societal and technological advancement. The philosophy of science, the body of knowledge of science, and the scientific process to discover knowledge will all be discussed. The chapter will provide an overview of the different branches of science, the different forms of scientific research, and the types of methods used. The chapter will discuss empirical evidence provided by scientific research methods and explain the hierarchy of evidence, as well as discussing why the scientific method requires that beliefs and preferences are subordinated to data and information. The continuum of discovery is introduced with a brief historical review of the investigations to understand the planetary motion of the solar system.

Key words

Body of knowledge; continuum of discovery; empirical evidence; research; scientific method; scientific process; skepticism

Science is a powerful tool through which humans have made amazing societal and technological advancement. Science has enabled us to understand our place in the universe, prevent and treat diseases, and even create the Internet. Why then with such a powerful resource at our disposal do we not apply more science practices to cyber security research? If we want cyber security to grow and evolve as a science then it is necessary to start focusing our research on more scientific methods.

In this book, we aim to provide you with and introduction into what it means to execute science in the context of cyber security research by following rigorous and established methods. This book seeks to borrow from the thousands of years of development of the scientific method in other disciplines, and to enhance the conduct of cyber security research as a science in its own right. The intended outcome from using this book is research that is relevant, repeatable, and documented such that colleagues can understand and critique the results and conclusions. The focus of this book is on the practical side of science, the research methods that can be used to perform your research. However, as this may be your first foray into the world of science, it is important to first explain what science is and provide an example of how, over time, it has had a major impact on our knowledge and understanding.

In this chapter we will introduce you to science, defining the various meanings of science, and how science has been cultivated within different fields of research. The continuum of science will be presented to explain where different methods fit in the spectrum. Finally, the concepts of science will be presented through an example. The example will explore the historical progression and improvement of knowledge through science for our, now, well-known solar system.

Chapter Objectives

Introduce science

Overview of forms of research and their types of methods

Describe the continuum of discovery and the hierarchy of evidence

Explore historical scientific advances in astronomy to contextualize concepts

What is Science

Science is an overloaded term that is used under many different contexts. It is important to understand that science represents three things: a philosophy, a body of knowledge, and a process to discover knowledge. The philosophy of science explores what it means to be an observer of the universe from within it. The body of knowledge of science encapsulates that which we have learned about the universe. Finally, the method of science is a rigorous process to generate evidence for knowledge assimilation from observing the world. While all aspects of science are interesting topics worth in-depth exploration, this book is focused on the practical aspects of science and the methods of collecting knowledge about cyber space and security.

What science is not is engineering. Engineering turns the knowledge gained through science into usable applications and solutions to address challenges or problems. While technically applying science is not science, it is a critical part of cyber security and similar to science, which requires a rigorous process if done right. Therefore, applied research methods are covered in this book.

The process of science has evolved into current forms with the goal of instilling confidence in what we learn from observation. In order to achieve this there are multiple important characteristics of research methods. First, research methods provide a rigorous and methodical approach to study. This ensures that the execution of research is thoroughly conceived and disciplined. Second, research methods provide a process to empirically ground theories and conceptual models. Third, research methods ensure that evidence is driven by logical and reasoned thinking. Finally, research culture is imbued with a healthy level of skepticism to always challenge the approach and results found to instill confidence in accepted knowledge.

Through the process of research science strives for knowledge with two valuable attributes. First, knowledge explains phenomena and what processes affect behavior in systems. Second, it provides an ability to predict future events by projecting from current state and possible stimuli. Armed with this type of knowledge, we are able to effectively engineer technologies that solve societal problems or make some process more efficient. In the case of cyber security, the goal of scientific exploration is to gain the knowledge to make it possible to quantify security and predict what tools and practices will enable us to thwart or stymie cyber attackers.

Types of Science

Science can take many forms. In our quest for knowledge we have explored many different fields of study. Each field represents a core set of questions that to answer them pose unique challenges. Owing to these challenges, each field has developed an approach to scientific research to best generate empirical evidence to validate theories. Out of these approaches have fallen a set of research methods that are used by their research communities to continue to build their knowledge base. The following table provides a brief overview of the different types of researches with example fields of study.

As you can see in Table 1.1, each category of research relies upon different forms of research methods. However, each field uses all forms of research methods at some level. The majority of this book covers these forms of research and specific useful methods for cyber security research. These forms of research include observational, mathematical, experimental methods.

Table 1.1

Description and Examples of Branches of Science

Branch of Science	Driving Scientific Approach	Example Fields of Study
Physical Sciences	The physical sciences are driven by controlled experiment validation of theories.	Physics, Chemistry
Life Sciences	The life sciences have a cross between observational methods to learn about life systems and experimental investigation of how living beings chemistry works.	Biology, Ecology
Social Sciences	Involves qualitative or descriptive research. Uses best fit models and observation to define operational models.	Psychology, Sociology, Criminology
Mathematical Sciences	Uses formalisms, logic, and mathematical constructs to define and explore abstract space and conceptual models.	Logic, Mathematics,
Data Science	Computational field that uses algorithms to generate models and hypotheses from empirical data.	Machine Learning, Artificial Intelligence

Observational—The phenomenon of interest is embedded in a larger system that is dynamic. The investigator can seek instances where the dynamics are less noisy, but it’s not possible to conduct an experiment free of influences from uncontrolled or uncontrollable variables. Very often, a test bed or microcosm is developed, which is a simplification of the natural environment in order to gain an understanding of basic relationships among variables associated with the phenomenon of interest.

The vast majority of science research engages in some form of observational experiments, using simplifications to gain understanding. One example is biological research using genetically controlled strains of experimental animals to clarify dose responses to chemicals or pharmaceuticals, and tissue cultures to study the basics of cell biology without the complexities of those tissues functioning within a live organism. Another example is physics experiments conducted with accelerators to control the energy and location of subatomic particle collisions in order to be able to collect data on the outcomes of those collisions.

In all of these cases, one can argue that the experimental setup is artificial and that the results may not reflect what actually occurs in the wild. However, collecting data on fortuitous subatomic particle collisions in wild is not practical, and testing chemicals and pharmaceuticals on humans as initial experiments is unethical. Test beds are necessary in order to advance our knowledge.

Mathematical—Unlike experimental and observational research, mathematical research is based upon logic and formal proofs. There is a persistent debate on whether mathematics is actually a science because science relies on evidence, not logic. We will leave that debate to others. What is true is that advances in mathematics are very often the precursors to advances in experimental and observational sciences. Mathematics is necessary for data collection, analysis, and interpretation.

Experimental—The investigator has full control of the phenomenon being observed and the mechanisms for data collection. All of the variables are known and can be either held constant or made to change in order to assess the consequences of those c...