Every example in this course, from spam filtering above to the adversarial-attack experiments in Unit 6, follows the same five-stage pipeline. Learning to see this pipeline in every problem is the single most transferable skill this course teaches.
- Collect labelled or unlabelled data: network flows, file samples, email corpora, transaction logs.
- Engineer features: turn raw data (a PCAP file, an email, a binary) into numeric vectors a model can consume. Unit 5 is built entirely around this step.
- Train a model on a training split, holding out a separate test split it never sees during training.
- Evaluate on the held-out test split, using metrics that actually fit the problem, not just accuracy (Unit 6 explains why accuracy alone misleads).
- Deploy and monitor: a model's accuracy at launch is not its accuracy six months later, because attackers adapt and legitimate behaviour drifts. A deployed model needs retraining, just as a signature database needs updating.
Try it yourself: Count the Imbalance in Your Own Inbox
Export the last 200 messages from any email account's spam folder and 200 from its inbox (most mail clients allow a simple export to .mbox or .csv). Without training anything yet, count how many spam messages share a sender domain, and how many legitimate messages do. You are doing feature engineering already, by hand, before Unit 5 formalises it.
Caution: A Model Is Only as Good as Its Training Data
Every classifier in this course will cheerfully give you a confident, wrong answer if you feed it data unlike anything it trained on. A spam filter trained only on English-language spam will struggle with spam in another language, not because the model is broken, but because it never saw that distribution. Keep this in mind every time this course reports a strong accuracy number: strong on which data is always the real question.
Key takeaway
Machine learning does not replace an analyst's judgement; it generalises the analyst's past judgement to new cases faster than any human could review them one by one. Every method in this course is one of three families, supervised, unsupervised, or reinforcement learning, applied through the same five-stage pipeline: collect, engineer features, train, evaluate, deploy and monitor.