Every supervised model in this unit answers one question in one shape: given a vector of features $x$ describing a file, a URL, or a transaction, predict a label $y$. For a binary security problem, $y$ is almost always 0 or 1, benign or malicious, legitimate or fraudulent. The model is trained by showing it many pairs $(x_i, y_i)$ and adjusting its internal parameters until its predictions match the known labels as closely as possible, then tested on pairs it never saw during training.
ML concept: Training Split, Test Split
Never evaluate a model on data it trained on; it will look deceptively good, because it can partly memorise the training set rather than learn a generalisable pattern. scikit-learn's train_test_split sets aside a portion, typically 20 to 30 percent, that the model never sees until evaluation. Every classifier built in this course respects that split.
Key takeaway
This unit builds four classifier families, decision trees, random forests, support vector machines, and gradient boosting, on malware and phishing detection tasks, and shows how to read the results honestly. Every one of them answers the same $x \to y$ question; what differs is how each one gets there.