Before training a single model, it helps to have a map of what we are actually defending against. Nearly every threat a security team meets falls into one of four broad families, and each family favours a different kind of model, which is exactly why this course is organised the way it is.
- Malware: software built to cause harm, from commodity trojans to targeted, custom-built tools. Classified in Unit 2 and Unit 5 using features extracted from the file itself or its behaviour.
- Social engineering: phishing emails, fraudulent SMS messages, fake websites. These rely on language and presentation, so Unit 5 brings in natural language processing specifically for this family.
- Network intrusion: scanning, lateral movement, data exfiltration, denial-of-service traffic. Often has no ready label, so Unit 3's unsupervised methods matter most here.
- Fraud and abuse: fraudulent transactions, fake accounts, credential stuffing. Characterised by extreme class imbalance, a theme Unit 2 and Unit 6 both return to.
Case study: The Spam Arms Race
Early spam filters, through the 1990s, were simple keyword blacklists: block any message containing "viagra" or from a known bad sender. Spammers defeated this within weeks by misspelling words and rotating sending addresses. In 2002, the programmer and essayist Paul Graham published "A Plan for Spam," showing that a simple statistical classifier, a Naive Bayes model scoring each word's historical association with spam, caught far more spam with far fewer false positives than any hand-written rule list. His approach, and the open-source filters that implemented it soon after, most notably SpamAssassin, is the direct ancestor of every spam and phishing classifier in production today, including the one you will build in Unit 5. The lesson has held for over two decades: a model that learns the pattern from data keeps working after an attacker changes a few words; a hand-written rule list does not.
Try it yourself: Classify the Family
A new fake-invoice email campaign slips past an organisation's spam filter by writing invoice text that varies slightly in every copy, while the payment account number changes weekly. Which threat family does this belong to, and which later unit of this course would you reach for first to catch it: the unsupervised methods in Unit 3, or the NLP methods in Unit 5?