Lab notebook
In-depth analyses of malware samples, technique deep-dives, and lab notes from the field. Long-form, technical, no fluff.
148 articles across all categories — page 4 of 17
Questionnaires, interviews, and sandbox telemetry, and the tradeoff between an instrument's reach and its depth -- a questionnaire scales to 500 employees, an interview does not, but it surfaces what no tick-box question would.
Running a phishing simulation and recording who clicks is primary data. A CERT's published incident record is secondary data the moment someone else picks it up. The difference decides how much you can trust what you reuse.
A design chosen after the data are already in hand is not a design -- it is a story built to fit whatever numbers turned up. Eight common designs, and why correlational findings get misread as causal ones constantly.
A literature review is not a summary of everything ever written on a topic. Six stages, a worked search-string example, and why snowballing catches papers that keyword search quietly misses.
An ordinary literature review reflects the author's own judgement about which papers deserve discussion. A systematic one is designed so its search and selection process can be repeated by someone else -- here is what that actually requires.
Eight databases worth knowing for computer science and digital forensics research, why an arXiv preprint is not the same as a peer-reviewed paper, and how to handle grey literature like CERT-In advisories honestly.
A quarter of 36 published malware papers made questionable dataset assumptions; 71 percent described no safety precautions at all. Reproducibility failures in this field are not hypothetical -- they are documented, at scale.
Zotero, Mendeley, and EndNote compared, and the capture-to-citation workflow that turns a browser bookmark into an auto-formatted citation in a LaTeX thesis.
Reading five blog posts and summarising them is not research. Here is the actual bar -- six tests a study has to pass, four objectives it can serve, and a WannaCry timeline to practice telling them apart.
