It is tempting, after Unit 2, to think the choice of classifier is what separates a strong security model from a weak one. In practice, a strong feature set carries a simple classifier further than a weak feature set carries a sophisticated one. A random forest trained on features that actually capture how phishing URLs differ from legitimate ones will beat a neural network trained on raw, unprocessed URL strings. This unit treats feature engineering as a craft with its own techniques, not an afterthought before "the real modelling."
ML concept: What Makes a Good Security Feature
A good feature is discriminative (its value genuinely differs between classes), available at decision time (you cannot use a feature that only exists after the damage is done), and robust to easy evasion (a feature an attacker can flip with one trivial change, such as a single extra space in an email, is a weak feature). Every feature introduced in this unit is checked against these three tests.
Try it yourself: Which Test Does Each Feature Fail?
A phishing classifier uses "whether the user later reported this email as phishing" as a feature. A malware classifier uses "whether the antivirus product eventually flagged this file" as a feature. A third classifier uses "whether the message contains the exact phrase 'URGENT ACTION REQUIRED' in all capital letters" as its only urgency signal. For each of these three features, identify which of the three tests, discriminative, available at decision time, or robust to evasion, it fails, and why.