Upper quartile

As explained in Cyber Threat Hunting

The upper quartile is the value below which 75 percent of observations fall in an ordered dataset.

The upper quartile, or third quartile, is the value below which 75% of observations fall when an ordered dataset is arranged ascending. It marks the boundary of the upper half of the interquartile range. section 7.1.2

In analytic work, the upper quartile helps retain the central 50% of values: observations above it can be excluded alongside values below the lower quartile before calculating variance or standard deviation. section 7.1.2

A practical workflow uses the quartile boundaries to reduce distortion from noisy connection data:

• Arrange the measurements in ascending order and identify the lower, median, and upper quartiles. section 7.1.2
• Drop rows whose time_diff_sec values fall below the lower quartile or above the upper quartile. section 7.1.2
• Calculate standard deviation and variance on the retained connection groups. section 7.1.2

Filtering connection jitter

For grouped network connection records, removing time_diff_sec values outside the lower and upper quartiles reduces the influence of jitter, outliers, and skew before statistical comparison. section 7.1.2

Figure 7.4 Quartiles for a nonnormal distribution

Use the quartile diagram to see how the upper quartile partitions a nonnormal distribution. section 7.1.2

How Cyber Threat Hunting covers it

How deep it goes

Defines the 75% boundary and applies it in an IQR workflow, stopping short of deriving quartile calculation methods.

Examples

Demonstrates upper-quartile filtering on time_diff_sec values from grouped network connection records.

What it assumes

Assumes familiarity with ordered data and basic variance or standard deviation, while defining quartiles and medians.

What you can do after

Diagnose noisy connection timing by filtering values outside quartile boundaries before calculating variability.

How it connects

Connects upper quartile with interquartile range, lower quartile, median, outliers, skewed data, variance, and standard deviation.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  D3.js in Action, Third EditionThe 75th percentile is the value below which approximately 75 percent of an ordered dataset falls and is also called the third quartile.
• 

  liveBookmanning.com
  Statistics Slam DunkThe upper quartile is the value marking approximately the 75th percentile of an ordered set of observations.

Compare how 3 books explain upper quartile →

Related concepts

• quantileskind of · A quantile is a value that divides an ordered dataset or probability distribution so that a specified proportion of observations lies at or below it.
• quartilekind of · A quartile is a quantile or cut point that divides ordered observations into four approximately equal parts.
• percentileequivalent to · A percentile is a value in an ordered distribution at or below which a specified proportion of observations falls.
• interquartile rangeused by · The interquartile range is the difference between the third and first quartiles of a distribution, measuring the spread of its middle half.
• quantile quantizationused by · Quantile quantization transforms numerical values into discrete levels or buckets using thresholds derived from the values’ distribution quantiles.
• box-and-whisker plotused by · A box-and-whisker plot is a statistical graphic that summarizes a numerical distribution using quartiles, a median, and whiskers or markers indicating spread and potential outliers.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.