Analogy: The Locksmith and the Unfamiliar Lock
A locksmith who only ever fits one brand of lock eventually meets a door it cannot open. A security team that only ever matches known signatures eventually meets a threat with no signature yet, because the threat is new, or because the attacker deliberately changed just enough to slip past the list. Machine learning does not replace the locksmith's skill; it gives the locksmith a way to recognise an unfamiliar lock's family, even one they have never personally picked before, by noticing what unfamiliar locks of that family tend to have in common.
That is the whole idea of this course in one sentence: instead of writing down every rule a human analyst can think of, we show a model enough labelled or unlabelled examples that it can infer the rule, or at least a useful approximation of one, on its own. The rule a human writes is only as good as the human's imagination. A rule learned from ten thousand real phishing emails has seen patterns no single analyst would ever have thought to write down.
ML concept: Supervised, Unsupervised, and Reinforcement Learning
This course uses three families of machine learning, one or more per unit:
- Supervised learning (Unit 2, Unit 5): the training data is already labelled, "this email is spam," "this binary is malware." The model learns a function from input features to a known label.
- Unsupervised learning (Unit 3): there are no labels at all. The model finds structure, clusters, outliers, lower-dimensional patterns, on its own.
- Reinforcement learning (Unit 4): there is no fixed dataset at all. An agent takes actions in an environment, observes a reward, and learns a policy that maximises reward over time.
Every one of the six units in this course is one of these three ideas, applied to one concrete security problem.
Key takeaway
Machine learning does not replace an analyst's judgement; it generalises the analyst's past judgement to new cases faster than any human could review them one by one. The rest of this unit builds toward one concrete, runnable example of exactly this generalisation.