Lab notebook
In-depth analyses of malware samples, technique deep-dives, and lab notes from the field. Long-form, technical, no fluff.
41 articles in "research-methodology" — page 3 of 5
Reporting a result is saying what the data showed. Interpreting it is explaining what it means. Mixing the two in the same paragraph is the most common structural error in a results chapter, and examiners are trained to catch it.
A citation is not a formality. It is an evidence claim: "this source supports what I just said." Getting the format right matters, but getting the content right — that the source actually says what the citation implies — matters more.
An abstract must stand alone: it is often the only part a reader reads. A conclusion must synthesise: it is not a summary of what each section contained. Both are written last and both are commonly written badly.
The choice of software rarely changes what a test does -- it changes how quickly and how reproducibly the work gets done. A worked paired t-test in Python, and why "we ran a t-test" is not enough for a methodology section.
Not every number means the same thing. Averaging a low/medium/high/critical rating and reporting it as a precise 2.65 is one of the most common statistical errors in student projects.
Questionnaires, interviews, and sandbox telemetry, and the tradeoff between an instrument's reach and its depth -- a questionnaire scales to 500 employees, an interview does not, but it surfaces what no tick-box question would.
Most tests a security research project will ever need fall into a small set. The choice turns on two questions: how many groups are being compared, and whether the outcome is continuous or categorical.
Almost no study can examine an entire population. How the sample is chosen decides how far the findings can be trusted to represent the whole -- and a convenience sample is not automatically a bad choice, just one with a cost you must disclose.
Reliability is about how tightly your measurements cluster. Validity is about whether that cluster sits on the target. Unit 2's two biggest reproducibility failures turn out to be exactly these problems wearing different names.
