Graph can be used for a couple different things. like path traversal and grouping. One of the highlights of graph it is the most visual. For some analyses you need to create a chart to demonstrate the immportant takeaways, in
Path traversal, moving in physical space to find the shortest path from point A to B.
Groups - graph built on linear algebra concepts allows us to look at relationships of high dimesnioanl objects. How 'far' these objects are away from eachother can help us to identify groups and patterns.
Networking. Looking at something like how resilient a network is can be done by graph.
2 kinds of objects, nodes (The objects) and edge(the relationships to of one node to another). I like to think of graph as Nodes are nouns, (edges)verticies are verbs. Nodes are the things and edges are the relationshsips between the things.
Simple example of 4 nodes and 3 edges
Imagine our boss wants to know the shortest path from a workstation to another. How many steps does it take to get from workstation 19 to workstation 17. We can use graph
Bredth First Search can be used to show how many steps it takes from initial to anyother.
Color key
More involved example from HTB CTF - https://github.com/dbissell6/DFIR/blob/main/WalkThroughs/Cyber_Apocalypse_2024.md#path-of-survival---hard
Lets imagine your boss wanted you to analyze some security data
For the past couple years every month your company kept statistics on some security variables.
External_Threat_Intelligence_Alerts
Internal_Security_Audits
User_Awareness_Training
Endpoint_Security_Compliance
Detected_Security_Incidents
(This is all pseudo data, dont try to make any real conclusions from this, demonstration purposes only)
As we learned back in stats, to compare the relationship of two variables we can use covariance, or get the normilzed version, correlation.
Heatmap
Looking at the heatmap it illustrates two important concepts mentioned before.
a variable correlated to itself will always be 1, that is why we see the diagnoal line.
If the information is mirrored along that diagnoal line we know the graph is not bidirectional.
the variables are our nodes, and the correlations are the edges.
Seeing the same thing with graph
