Correlation measures the strength and direction of a relationship between variables. In cybersecurity, it can reveal patterns that are hard to see in raw data, such as whether failed login attempts rise alongside phishing emails. section 11.4
A correlation matrix puts relationships on a scale from −1 to 1:
- 1 means a perfect positive correlation: both variables increase together. section 11.4
- −1 means a perfect negative correlation: one variable increases as the other decreases. section 11.4
- 0 indicates no correlation between the variables. section 11.4
Login monitoring
Compare login hours with counts of failed attempts, then inspect the correlation matrix as a heatmap. A relationship may justify closer monitoring at unusual hours. Before changing authentication policy, check the context: employees in different time zones could also explain late-night failures. section 2.3.2 section 11.4
Listing 11.1 Hidden relationships
#Import libraries import seaborn as sns #1 import pandas as pd #2 import matplotlib.pyplot as plt #3 #Example dataset: Login hours and failed attempts data = {'Login_Hour': [8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3], #4 'Failed_Login_Attempts': [2, 3, 4, 5, 3, 6, 7, 5, 8, 9, 12, 13, 10, 8, 7, 5, 2, 3, 4, 5]} #5 df = pd.DataFrame(data) #6 #Calculate correlation matrix correlation_matrix = df.corr() #7 #Plot heatmap plt.figure(figsize=(8, 6)) #8 sns.heatmap(correlation_matrix, annot=True, cmap='Grays', cbar=True) #9 plt.title('Correlation Between Login Hours and Failed \ Login Attempts') #10 plt.show() #11
Run the synthetic login dataset through pandas’ corr() method and view the result with a seaborn heatmap; the example requires no preprocessing. section 11.4
Correlation is a lead, not proof of cause. Validate the data and bring security context to the result before calling a pattern an attack. Used alongside other metrics, it can help prioritize investigation, monitoring, and future planning. section 2.3.2 section 11.1.1
