X.1 Odd Questions❓

# When a Question Makes No Sense

• Sometimes a question uses a term you've never seen anywhere.
• Panic? Leave it blank? Neither.
• A sensible meaning, clearly stated and well explained, still earns marks.
• Here are the odd ones asked so far, with safe answers.

# Matrix Mining PYQ 5M

"Matrix mining" is not a standard security term. It is best read as data mining on security data arranged in a matrix, used to find attacks and anomalies.

Matrix mining (as read here) is finding hidden patterns and unusual entries in a table of security data, where each row is an event (a connection, a login, a transaction) and each column is a feature of it.

• Data mining itself means discovering useful patterns in large amounts of data, using statistics and machine learning.
• Information systems collect and store this data (→ 3.2).

Example matrix (rows = network connections):

• Row 4 stands out: huge data transfer, many failed logins and an unusual port. Mining flags it as a likely attack.

Steps

1. Collect data: logs, network traffic, login records (→ 4.5).
2. Build the matrix: one row per event, one column per feature.
3. Clean and normalise: remove duplicates and errors; bring values to a common scale.
4. Reduce features: matrix methods such as PCA or SVD keep the most informative columns.
5. Mine: apply a technique (below) to find patterns or outliers.
6. Interpret and act: raise alerts, update IDS rules, investigate (→ 6.7).

flowchart TD
    A["<b>Collect</b><br>logs, traffic"]:::blue --> B["<b>Build matrix</b><br>events × features"]:::blue
    B --> C["<b>Clean, reduce</b><br>normalise, PCA"]:::amber
    C --> D["<b>Mine</b><br>classify, cluster, rules"]:::amber
    D --> E{"<b>Unusual pattern?</b>"}:::amber
    E -->|"yes"| F["<b>Alert</b><br>investigate"]:::red
    E -->|"no"| G["<b>Normal</b><br>update baseline"]:::green
    classDef blue fill:#5b84d424,stroke:#5b84d480
    classDef amber fill:#d6a24424,stroke:#d6a24480
    classDef red fill:#d0707024,stroke:#d0707080
    classDef green fill:#52a86e24,stroke:#52a86e80

Mining techniques

• Classification: labels each row as normal or attack, learned from past examples (signature-style detection).
• Clustering: groups similar rows; small, far-off groups are suspicious (anomaly detection).
• Association rules: finds links such as "many failed logins → then a large download".
• Outlier detection: flags rows far from normal, like row 4 above.

Uses in cyber security

• Intrusion and anomaly detection · credit-card and banking fraud detection · spam and phishing filtering · malware classification · spotting insider threats.

Other possible meanings (mention briefly if writing the answer)

• Access-control matrix mining (role mining): the user–permission matrix (rows = users, columns = permissions) is mined to find common roles and remove excessive access.
• Matrix Profile: a time-series data-mining method that compares every stretch of traffic with all others; unusually different stretches can reveal attacks such as DDoS.
• A misprint for "data mining": the same answer applies.

# Three Ps of Cybercrime PYQ 3M · other

The most likely meaning: the first three of the 5P mantra for staying safe online: Precaution, Prevention, Protection (followed by Preservation and Perseverance).

1. Precaution: think before you act online.
   • Example: don't click unknown links or share your OTP and passwords.
2. Prevention: use tools and habits that stop attacks before they happen.
   • Example: antivirus, firewall, regular software updates.
3. Protection: guard your data and devices so damage stays small even if an attack succeeds.
   • Example: strong passwords, two-factor login, encryption, backups.

• The remaining two Ps: Preservation (keep evidence such as screenshots and messages, and report the crime) and Perseverance (follow up the complaint and keep learning).
• These are a victim-side defence against cybercrime (→ 2.2).

Other possible readings

• Prevention, Protection, Prosecution: stop crime, protect victims, punish offenders under the law (→ 5.5).
• People, Process, Technology: the three pillars of cyber security (trained people, clear procedures, the right tools).

# Attempting Any Unclear Question

1. State your meaning in the first line: "Here, X is taken to mean …".
2. Define the terms you are using.
3. Link it to the nearest known topic (data mining → intrusion detection; Ps → cybercrime prevention).
4. Give a structured answer: definition, steps or points, example.
5. Add a small diagram or table if it fits.
6. If space allows, mention one other possible meaning in a line.