From "what's the chance of this one thing" to modeling every possible outcome at once.
In Day 7, we learned to compute the probability of one specific event. Questions like "what's the probability of rolling a 5?" or "what's the probability this email is spam?"
But data science rarely deals with single, isolated events. The questions that actually come up tend to look more like this: how many items does a typical Amazon shopper add to their cart before checking out, and what's the probability it's more than 10? How long does a Netflix user browse before picking something, and what's the probability they give up within 90 seconds? How many people will click on this ad today?
Notice the shift. We're no longer asking about one outcome. We're asking about the entire range of possible values, and the probability attached to each one. Answering questions like that takes two new ideas: random variables and probability distributions.
A random variable is a variable whose value is the numerical result of a random experiment. It's a way of attaching numbers to outcomes so you can actually do math with them.
Think of it as a function. It takes a raw outcome, like "the user clicked," and turns it into a number, like 1 for a click and 0 for no click. Once outcomes become numbers, you can compute averages, spreads, probabilities, all the tools we've built up over this whole series.
Random variables get a capital letter, like X or Y. A specific value that variable takes gets a lowercase letter, like x. So P(X = x) reads as "the probability that the random variable X takes the value x."
Random variables come in exactly two flavors, and which one you're dealing with changes everything about how you work with it.
Discrete random variables take on a countable number of distinct values, usually whole numbers, with real gaps between them. The number of ads a user clicks in a session: 0, 1, 2, 3, but never 1.7. The number of bug reports filed on GitHub in a day. The number of support tickets Uber receives per hour. The result of rolling a die: 1 through 6, nothing in between.
Continuous random variables can take any value within a range, decimals and fractions included, with no gaps at all. The time a Netflix user spends browsing before picking a title could be 23.7 seconds or 104.2 seconds. A webpage's exact load time in milliseconds. The temperature an IoT sensor records on a server rack. A user's exact session length on Spotify.
With a discrete variable, you can list every possible value and ask "what's the probability of exactly this one?" With a continuous variable, there are infinitely many possible values, so the probability of hitting any single exact value is zero. You have to ask about a range instead. This one distinction drives everything that follows in this article.
We just defined a random variable as a function that maps outcomes to numbers. Say X = "number of items added to a cart" can take values 0, 1, 2, 3, and so on. But knowing which values are possible is only half the story. The more important question is: how often does each value actually happen?
That's exactly what a probability distribution tells you. It's a complete description of a random variable: it lists every value the variable can take, and assigns a probability to each one. Together, those probabilities paint a full picture of how the variable behaves.
Let's build one from the simplest experiment there is: rolling a single fair die. Define X as the face value shown after one roll. X can take the values {1, 2, 3, 4, 5, 6}, and since the die is fair, every outcome is equally likely.
| x (value) | P(X = x) |
|---|---|
| 1 | 1/6 ≈ 0.167 |
| 2 | 1/6 ≈ 0.167 |
| 3 | 1/6 ≈ 0.167 |
| 4 | 1/6 ≈ 0.167 |
| 5 | 1/6 ≈ 0.167 |
| 6 | 1/6 ≈ 0.167 |
| Total | 1.000 |
This table is the probability distribution. Two things about it are worth noticing right away. First, every probability sits between 0 and 1, nothing is impossible, nothing is guaranteed. Second, all the probabilities add up to exactly 1.0, since the distribution has to account for every possible outcome, no exceptions.
That second point isn't just a technicality. It's the normalization rule, a direct consequence of the basic axioms of probability, and it's the one requirement every valid probability distribution must obey, no matter how simple or complicated it gets. (It's a different idea from the "law of total probability" you may see elsewhere, which is a specific technique for computing a probability by summing over conditional probabilities. Similar spirit, different tool.)
Here's where the road splits, based on what kind of random variable you're working with. If X is discrete, you describe its distribution with a Probability Mass Function, or PMF. If X is continuous, you use a Probability Density Function, or PDF. Both exist to describe the same thing, a distribution's shape, but they work in very different ways because discrete and continuous data behave so differently. Let's take each in turn.
For discrete random variables, the distribution is described with a Probability Mass Function, or PMF: a function that gives you the exact probability of each possible value.
Think of a PMF as a complete lookup table. For every possible value, it hands you a probability. And if you add up every probability in the table, you get exactly 1, because something has to happen.
Say Uber's data team looks at a year of data and finds this distribution for the number of rider support tickets received per hour during peak time:
| Tickets per hour (x) | 0 | 1 | 2 | 3 | 4 | 5 |
|---|---|---|---|---|---|---|
| P(X = x) | 0.05 | 0.15 | 0.30 | 0.25 | 0.15 | 0.10 |
Check that it's a valid PMF first: 0.05 + 0.15 + 0.30 + 0.25 + 0.15 + 0.10 = 1.00. Good, it holds up.
Now you can answer questions directly. The probability of getting exactly 2 tickets in an hour is P(X = 2) = 0.30, or 30%. The probability of getting more than 3 is P(X > 3) = P(X=4) + P(X=5) = 0.15 + 0.10 = 0.25, or 25%.
You're a data analyst at a fintech startup, studying how many transactions per minute get flagged by the fraud detection system during peak hours. Historical data gives you this PMF:
| x (flagged transactions/min) | P(X = x) |
|---|---|
| 0 | 0.10 |
| 1 | 0.25 |
| 2 | 0.35 |
| 3 | 0.20 |
| 4 | 0.07 |
| 5 | 0.03 |
Now you can answer precise operational questions. What's the probability of exactly 2 fraud flags in a minute? P(X = 2) = 0.35. What's the probability of more than 3 flags? P(X > 3) = P(X=4) + P(X=5) = 0.07 + 0.03 = 0.10. Is it more likely to see 0 flags or 5 flags? P(X=0) = 0.10 versus P(X=5) = 0.03, so 0 flags is more likely.
This is the PMF doing exactly what it's built for: turning uncertainty into numbers you can actually act on.
GitHub's internal engineering team tracks how many bug reports get filed per day for a given product. From 200 days of data, they observe: P(0 bugs) = 0.10, P(1 bug) = 0.25, P(2 bugs) = 0.35, P(3 bugs) = 0.20, P(4 bugs) = 0.10.
This lets the team answer something that matters for sprint planning and on-call scheduling: on any given day, what's the probability of having more than 2 bugs to fix?
First, check the PMF is valid: 0.10 + 0.25 + 0.35 + 0.20 + 0.10 = 1.00. Good. "More than 2 bugs" means P(X > 2), so add up X=3 and X=4: P(X > 2) = 0.20 + 0.10 = 0.30. And "at most 1 bug" means P(X ≤ 1), so add X=0 and X=1: 0.10 + 0.25 = 0.35.
Here's the problem: what happens when you try to apply the PMF idea to a continuous random variable, like page load time?
Imagine asking "what's the probability a page loads in exactly 312 milliseconds?" The answer is essentially zero. Not because it can't happen, but because on a continuous scale, hitting any single infinitely precise value has vanishing probability. If you tried to bar-chart every possible value the way we just did for discrete data, you'd end up with infinitely many bars, every single one with a height of zero, telling you absolutely nothing.
The fix is the Probability Density Function, or PDF. Instead of assigning probability to individual points, it assigns probability to a range.
For a continuous random variable, P(X = an exact value) is always 0. But P(a ≤ X ≤ b) equals the area under the PDF curve between a and b. Probability lives in intervals, not at single points.
The height of the PDF curve at any point is called the density, and it is not itself a probability. It tells you how tightly packed the probability is around that point. A tall peak means values near there are common. A flat stretch means values are spread thin.
Netflix's data shows that the time X, in seconds, a user spends browsing before choosing a title roughly follows an exponential distribution. Most users pick something quickly, and a small fraction browse for a long time. The curve starts high and falls off steeply to the right.
If you've seen this example before with a different first line, here's the correction: P(30 ≤ X ≤ 120) actually comes out to 45.3%, not 36.8%. The 36.8% figure floating around is really e−1, which is P(X > 90), the chance of browsing longer than the mean. It's a real number, just for a different question. Always trust the code over a remembered figure, and rerun it yourself if the two disagree.
The PMF and PDF are great at answering pin-point questions: "what's the probability of exactly 3 fraud flags" or "what's the probability a user browses between 30 and 60 seconds." But in the real world, data scientists more often need a different kind of question answered: what's the probability that X is at most some value? What fraction of customers churn within the first 30 days? What percentage of transactions are below a certain amount? What's the probability a model responds in under 200ms?
That's exactly what the Cumulative Distribution Function, or CDF, answers.
The CDF works for both discrete and continuous variables. For discrete variables, F(x) is the sum of every P(X = k) for k at or below x, you're adding up the PMF bars from the left up to x. For continuous variables, F(x) is the area under the PDF from negative infinity up to x, you're accumulating area as you sweep right along the curve.
A CDF always has the same basic shape: it starts at 0 (nothing has happened yet), climbs as x increases, and eventually reaches 1.0 (every outcome is now accounted for). That S-curve shape is instantly recognizable once you've seen it a few times.
Take the Uber support ticket PMF from earlier. The CDF is built by accumulating those probabilities left to right:
| x (tickets) | P(X = x) | F(x) = P(X ≤ x) |
|---|---|---|
| 0 | 0.05 | 0.05 |
| 1 | 0.15 | 0.05 + 0.15 = 0.20 |
| 2 | 0.30 | 0.20 + 0.30 = 0.50 |
| 3 | 0.25 | 0.50 + 0.25 = 0.75 |
| 4 | 0.15 | 0.75 + 0.15 = 0.90 |
| 5 | 0.10 | 0.90 + 0.10 = 1.00 |
Now you can read off answers instantly. There's a 50% chance of getting 2 or fewer tickets in an hour, since F(2) = 0.50. There's a 90% chance of getting 4 or fewer, since F(4) = 0.90.
Adding a running-total column to the earlier fraud PMF gives you its CDF:
| x | P(X = x) | F(x) = P(X ≤ x) |
|---|---|---|
| 0 | 0.10 | 0.10 |
| 1 | 0.25 | 0.35 |
| 2 | 0.35 | 0.70 |
| 3 | 0.20 | 0.90 |
| 4 | 0.07 | 0.97 |
| 5 | 0.03 | 1.00 |
Reading straight from the CDF column: the probability of 2 or fewer fraud flags per minute is just F(2) = 0.70. No adding required, that's the entire point of having a CDF in the first place, it's already accumulated for you. The probability of more than 3 flags is 1 − F(3) = 1 − 0.90 = 0.10. And the probability of between 1 and 3 flags inclusive is F(3) − F(0) = 0.90 − 0.10 = 0.80.
For continuous random variables, the PDF and CDF are two views of the exact same distribution. Plotted side by side, their relationship becomes obvious: wherever the PDF is tall, the CDF is climbing steeply. Wherever the PDF flattens out, the CDF barely moves at all.
A random variable maps random outcomes to numbers. It comes in two types: discrete (countable values) and continuous (any value in a range). The PMF gives exact probabilities for discrete variables. The PDF describes probability density for continuous variables, where probability is the area under the curve, never the height at a single point. The CDF accumulates probability up to any value and works for both types, and it's often the most practically useful of the three for answering real business questions. Together, these three tools give you a full mathematical portrait of a dataset.
Four questions to test whether this stuck.
Typos are discrete: you can have 3 or 4, never 3.5. Time between typos is continuous: it could be 12.3 seconds or 12.34 seconds, with no gaps between possible values.
0.3. Every valid PMF has to sum to exactly 1 across all its values, so P(X=3) = 1 − 0.2 − 0.5 = 0.3.
Because session length is continuous, and a continuous variable has infinitely many possible exact values. The probability of landing on any single one of them is 0. The question that actually has a real answer is something like "what's the probability the session lasts between 46 and 48 minutes," which is the area under the PDF over that range.
0.35. Subtract the smaller cumulative probability from the larger one: F(20) − F(10) = 0.75 − 0.4 = 0.35. That's the whole appeal of a CDF: once you have it, ranges become simple subtraction.
Random variables and their distributions are the scaffolding everything else in this series builds on. In the next article, we'll dive into specific discrete probability distributions, the named, reusable patterns (like the ones behind coin flips, support tickets, and rare events) that show up constantly once you know to look for them.