By the time you finish this course, you will recognise machine learning quietly running inside tools you already use. A modern email provider scores every incoming message for spam and phishing probability before a human ever sees it. An endpoint protection product scores an unfamiliar binary file for "maliciousness" using a trained classifier rather than, or alongside, a signature database. A network intrusion detection system clusters traffic flows and flags the ones that do not resemble any cluster seen before. A fraud team's transaction monitor scores every card swipe in milliseconds using a model trained on millions of past transactions, most of them legitimate.
| Security problem | Where ML fits | Unit |
|---|---|---|
| Malware and phishing classification | Supervised learning on labelled samples: is this file or message malicious? | 2, 5 |
| Network intrusion detection | Unsupervised clustering and anomaly detection on unlabelled traffic | 3 |
| Adaptive defence and deception | Reinforcement learning: an agent that decides how to respond, not just classify | 4 |
| Spam and phishing text analysis | Feature engineering plus natural language processing on message content | 5 |
| Fraud detection | Supervised learning on a severely imbalanced label (fraud is always rare) | 2, 6 |
Key takeaway
Every row in this table is a real, deployed pattern, not a hypothetical. The rest of this course builds each one from scratch, starting with the simplest version of the spam problem later in this unit.