Where a tree asks a sequence of axis-aligned questions, a support vector machine (SVM) looks for the single boundary, a line in two dimensions, a hyperplane in general, that separates the two classes with the widest possible margin on either side. Points near the boundary, the "support vectors," are the only ones that matter to where the boundary ends up; points far from the boundary could move or vanish without changing the model at all.
ML concept: The Kernel Trick
Real security data is rarely separable by a straight line. An SVM's kernel function implicitly projects the data into a higher-dimensional space where a straight boundary does separate the classes, without ever computing that higher-dimensional space directly. The radial basis function (RBF) kernel, kernel="rbf" in scikit-learn, is the default choice for most security classification tasks, because it can draw smooth, curved boundaries around clusters of either class.
svm_malware.py
from sklearn.svm import SVC
svm = SVC(kernel="rbf", C=1.0, gamma="scale", probability=True, random_state=11)
svm.fit(X_train, y_train)
print(f"Test accuracy: {svm.score(X_test, y_test):.3f}")
Try it yourself: Linear or RBF?
A security dataset's two classes form two clean, separable blobs on a scatter plot, with a straight line able to divide them almost perfectly. A second dataset's two classes form one class as a ring surrounding the other, with no straight line able to separate them at all. Which dataset genuinely needs the RBF kernel's curved boundary, and which one would a much simpler linear kernel handle just as well?