# Chapter 21 Labs: Research Methods and Dissertation Skills

This chapter covers how to do rigorous cybersecurity research: structuring a
literature review, designing and piloting surveys, running appropriate
statistical tests on security datasets, and writing a research ethics
application. All four labs are research-methodology exercises. Labs 1-3 use
the companion Jupyter notebooks shipped with the book
(`21a_lit_review_workflow.ipynb` and `21b_stats_for_cyber.ipynb`). Lab 4 is a
document-drafting exercise that requires only a word processor. The Docker
environment provides a pre-configured Jupyter Lab server with every required
Python package so students can run the notebooks without a local Python setup.

---

## Prerequisites

- Docker Desktop (or Docker Engine + Compose plugin) installed and running.
- ~500 MB free disk space for the `jupyter/scipy-notebook` image.
- A modern browser (Chrome, Firefox, or Edge).
- The book's companion notebooks in this chapter (notebooks/, opened under cyberbook/ in Jupyter)
  (`21a_lit_review_workflow.ipynb`, `21b_stats_for_cyber.ipynb`).
- Zotero (host-installed) for Lab 1 - see the host setup note in Lab 1 below.
- No internet connection required once the image is pulled.

---

## Quick Start

```bash
# From the repo root or this directory:
docker compose -f labs/ch21/docker-compose.yml up -d

# Open Jupyter Lab in your browser:
open http://localhost:8899/lab
# Navigate to cyberbook/ to find the chapter notebooks.
```

---

## Lab 1: Literature Review Sprint

**Objective:** Produce a structured five-paper literature review on a narrow
cybersecurity topic, document the search strategy, and generate a PRISMA 2020
flow diagram using the companion notebook.

### Host Setup (not containerised) - Zotero

Zotero is a free, open-source reference manager. It must be installed on the
host because it is a GUI desktop application that cannot be run headlessly in
a container.

- Download and install from: https://www.zotero.org/download/
- Install the Zotero Connector browser extension from the same page.
- Create a collection named after your chosen topic inside Zotero.

The notebook (`21a_lit_review_workflow.ipynb`) reads a Zotero CSV export, so
no live Zotero connection is needed inside the container.

### Setup

1. Start Jupyter: `docker compose up -d` then open http://localhost:8899/lab
2. Navigate to `cyberbook/21a_lit_review_workflow.ipynb` and open it.

### Walkthrough

1. Choose a topic narrow enough to survey in five papers (for example:
   "adversarial attacks on BERT-based NLP security classifiers" or "phishing
   detection using graph neural networks").
2. Install Zotero and the browser extension. Create a collection named after
   your topic.
3. Search ACM Digital Library, IEEE Xplore, and Google Scholar with a
   documented Boolean search string. Record the string and result count.
4. Screen titles and abstracts against stated inclusion criteria (peer-reviewed,
   published 2018-2026, directly relevant). Record exclusions with reasons.
5. Read all five selected papers. In Zotero's Notes field record for each:
   (a) research question, (b) method and dataset, (c) key finding,
   (d) one acknowledged limitation, (e) one unacknowledged limitation.
6. Export the Zotero library to CSV (`File > Export Library`, format: CSV).
   Open `21a_lit_review_workflow.ipynb` in Jupyter and run the PRISMA flow
   diagram generator on your export (follow the notebook cells).
7. Write a 400-word synthesis: one paragraph on what the papers agree on, one
   on what they disagree on or leave open, one sentence stating the gap that
   follows logically from the synthesis.

### Expected Output

- A PRISMA 2020 flow diagram showing records identified, screened, excluded,
  and included.
- A thematic map image generated by the notebook.
- A gap-analysis matrix in the notebook output.
- Your 400-word written synthesis in a separate document.

### Verify Completion

All notebook cells in `21a_lit_review_workflow.ipynb` execute without errors
and produce at least one plot output. The PRISMA diagram shows a plausible
funnel from total records to five included studies.

### Cleanup

The notebook state is saved to the mounted volume. Nothing to clean up for
this lab; the container can remain running for subsequent labs.

---

## Lab 2: Survey Design Clinic

**Objective:** Design and pilot a 10-question security survey, calculate
Cronbach's alpha for the Likert-scale block, and write a sampling strategy.

### Setup

Same Jupyter environment as Lab 1. Open `21b_stats_for_cyber.ipynb`.

### Walkthrough

1. Choose a security-relevant construct to measure (for example: "perceived
   self-efficacy in reporting phishing emails" or "trust in automated
   vulnerability scanners").
2. Draft a 10-question survey containing: a preamble with study purpose and
   consent statement; at least one demographic item; a 5-point Likert-scale
   block of at least 5 items measuring the construct; one open-ended item.
3. Pilot with 3-5 people. For each question note: (a) average time to answer,
   (b) any confusion, (c) whether the response distribution looks plausible.
4. Revise based on pilot feedback. Document every change and the reason.
5. Open `21b_stats_for_cyber.ipynb` and import your synthetic pilot data into
   the designated cell. Run the Cronbach's alpha calculation.
6. If alpha is below 0.7, identify the item with the lowest item-total
   correlation, remove it, and recalculate alpha.
7. Write a 200-word sampling strategy: target population, recruitment method,
   expected response rate, threats to representativeness.

### Expected Output

- A drafted 10-question survey instrument.
- Cronbach's alpha printed by the notebook (target >= 0.7 after any item
  removal).
- Item-total correlation table output.
- 200-word sampling strategy document.

### Verify Completion

The notebook cell that computes Cronbach's alpha runs without errors and
prints a numeric alpha value. If the initial alpha is below 0.7, a second
cell after item removal also runs and prints a higher value.

### Cleanup

No services to stop between labs.

---

## Lab 3: Statistics Drill

**Objective:** Analyse a synthetic CICIDS-2018-modelled dataset with
appropriate statistical tests, compare two classifiers, and interpret results
in plain language.

### Setup

Same Jupyter environment. Open `21b_stats_for_cyber.ipynb` (reuse the
already-running container).

### Walkthrough

1. Open `21b_stats_for_cyber.ipynb`. Locate the synthetic dataset cell (it
   generates a dataset modelled on CICIDS-2018 features with two classifier
   output columns - a baseline random forest and an improved deep-learning
   model - and true labels).
2. Calculate accuracy, F1 score, Matthews Correlation Coefficient (MCC), and
   false positive rate at 90% recall for both classifiers. Note the divergence
   between accuracy and MCC on the imbalanced dataset.
3. Run a Mann-Whitney U test comparing F1 scores across 10 bootstrapped
   evaluation runs. Report the U statistic, two-tailed p-value, and effect
   size (r = Z / sqrt(N)).
4. Apply Bonferroni correction for the number of comparisons you would make if
   also comparing precision and recall. State the adjusted significance
   threshold.
5. Run a one-way ANOVA and Tukey HSD post-hoc test across F1 scores of three
   classifiers (the notebook generates the third automatically). Produce a box
   plot showing the distributions.
6. Write a 300-word interpretation: which classifier wins, whether the
   difference is statistically and practically significant, evaluation
   limitations, and what additional data would be needed before a deployment
   recommendation.

### Expected Output

- A printed metrics table (accuracy, F1, MCC, FPR@90% recall) for both
  classifiers.
- Mann-Whitney U statistic, p-value, and effect size r.
- Bonferroni-adjusted alpha threshold.
- ANOVA F-statistic and p-value; Tukey HSD pairwise comparison table.
- Box plot figure (three classifiers, F1 distributions).
- 300-word interpretation document.

### Verify Completion

All notebook cells run without errors. The box plot renders with three labelled
groups. MCC and F1 for the deep-learning model are numerically higher than the
random forest baseline (as designed in the synthetic data).

### Cleanup

```bash
docker compose -f labs/ch21/docker-compose.yml down
# To also remove the downloaded image:
docker rmi jupyter/scipy-notebook:python-3.11
```

---

## Lab 4: Ethics Application

**Objective:** Write a sample research ethics application and informed consent
form for a qualitative cybersecurity study, and review a peer's application
using the Belmont principles.

### Host Setup (not containerised)

This is a pure document-drafting exercise. Use any word processor (Microsoft
Word, LibreOffice Writer, or Google Docs). No containerised service is needed.

### Walkthrough

1. Draft the following research scenario: you propose to interview 15 SOC
   analysts about their experience of alert fatigue, recording the interviews
   and retaining anonymised transcripts for three years.
2. Complete an ethics application covering:
   (a) Research purpose and research question.
   (b) Participant recruitment: who, how, inclusion and exclusion criteria.
   (c) Data collected: audio recording, transcript, interview notes.
   (d) Data storage: encrypted, institution servers, access controls.
   (e) Risks to participants: identification, professional consequences.
   (f) Risk mitigation: anonymisation procedures, consent withdrawal procedure.
   (g) GDPR legal basis for processing (Article 6) and a brief Data Protection
       Impact Assessment if required (Article 35).
3. Draft an informed consent form containing: plain-language study description,
   what participation involves, that participation is voluntary, how data will
   be used and stored, how to withdraw, and contact details for the researcher
   and the institution ethics committee.
4. Identify two ethical issues specific to interviewing cybersecurity
   practitioners that would not arise in an equivalent study of (say)
   marketing managers. Explain how you would address each.
5. Exchange your application with a peer and review theirs using the four
   Belmont principles (Respect for Persons, Beneficence, Justice,
   Non-Maleficence) as a framework. Provide written feedback of at least
   200 words.

### Expected Output

- A completed research ethics application document (approx. 1,500-2,000
  words).
- An informed consent form (approx. 400-600 words).
- A 200+ word peer-review critique using the Belmont framework.

### Verify Completion

The ethics application addresses all seven items listed in step 2. The consent
form addresses all six elements listed in step 3. The peer-review feedback
references at least three of the four Belmont principles by name.

### Cleanup

No Docker services involved.

---

## Teardown (all labs)

```bash
docker compose -f labs/ch21/docker-compose.yml down -v
```

This stops the Jupyter container and removes the network. The bound volume
(your repo directory) is not deleted.

---

## Safety and Authorisation Note

These labs contain no offensive tooling and make no network connections to
external hosts. The notebooks use entirely synthetic data modelled on public
datasets (CICIDS-2018). No real network traffic, personal data, or malware
samples are used anywhere in this chapter's labs.

All research activities described in the ethics application lab are
hypothetical exercises. Any real human-subjects research must receive
ethics committee approval before data collection begins. Under Irish law
(Data Protection Act 2018, implementing EU GDPR) and the Criminal Justice
(Offences Relating to Information Systems) Act 2017, unauthorised processing
of personal data and unauthorised access to information systems both carry
criminal penalties regardless of research intent.
