Local averaging smooths noisy measurements by calculating the arithmetic mean within a fixed-length sliding window. A simple moving average (SMA) moves forward with each new observation, reducing short-term variation so longer-term cybersecurity trends are easier to interpret. section 11.5 section 11.5.1
Use local averaging to turn fluctuating security metrics into more actionable decisions:
- Choose a metric and window, such as daily malware detections averaged over five days. section 11.5.1
- Compare the smoothed line with raw observations to distinguish sustained movement from isolated events. section 11.5.2
- Review the resulting trend against measurable goals, then adjust security protocols and monitor whether the change improves results. section 11.3
- Investigate large deviations from the moving average as possible anomalies rather than treating every spike as a sustained trend. section 11.5.2
Malware detection monitoring
A security team records malware detections for 30 days and calculates a five-day SMA. The smoothed line clarifies the general trajectory, while the raw daily series exposes unusual spikes or dips for investigation. An EMA can be added when recent events need more weight and faster response. section 11.5.1 section 11.5.2
Listing 11.2 Moving averages
import pandas as pd #1
import matplotlib.pyplot as plt #2
#Example malware detection data
data = {'Day': range(1, 31), #3
'Malware_Detections': [10, 8, 12, 15, 9, 11, 13, 8, 14,
16, 15, 13, 18, 20, 17, 14, 19,
21, 23, 17, 15, 14, 16, 13, 12,
18, 22, 25, 19, 9]} #4
df = pd.DataFrame(data) #5
#Calculate SMA and EMA
df['SMA'] = df['Malware_Detections'].rolling(window=5)
.mean() #6
df['EMA'] = df['Malware_Detections'].ewm(span=5,
adjust=False).mean() #7
#Plot the data
plt.figure(figsize=(10, 6)) #8
plt.plot(df['Day'], df['Malware_Detections'],
label='Daily Malware Detections', color='blue',
marker='o') #9
plt.plot(df['Day'], df['SMA'], label='Simple Moving \
Average', linestyle='--', color='green') #10
plt.plot(df['Day'], df['EMA'], label='Exponential \
Moving Average', linestyle='-.',
color='red') #11
plt.title('Malware Detections: Daily vs. Moving \
Averages') #12
plt.xlabel('Day') #13
plt.ylabel('Malware Detections') #14
plt.legend() #15
plt.grid() #16
plt.show() #17
Run the supplied Python listing to create daily malware data, calculate five-day SMA and EMA values, and plot raw and smoothed detections. section 11.5.1
