ML for Cyber Security
ML for Cyber Security
Sign in to save your progress, earn points, and unlock module exams.
Unit 6 of MLCS
Why accuracy lies on imbalanced security data, precision/recall/F1, adversarial evasion and poisoning attacks against trained classifiers, standard security datasets, and automating threat intelligence.
The real ULB fraud dataset's 0.17 percent positive class, and why a classifier that predicts legitimate for every single transaction scores 99.8 percent accuracy while catching zero fraud.
Reading a confusion matrix's four counts, the precision/recall/F1 formulas and what each one answers, why precision and recall trade against each other by threshold, and a real precision-recall curve on a severe 5 percent positive-class task.
The four adversarial attack categories, evasion, poisoning, model extraction, and model inversion, three real incidents including Goodfellow's 2014 panda-to-gibbon FGSM result, the FGSM idea itself, a real robustness-collapse chart, and a five-step defensive checklist.
A complete, runnable web application firewall classifier trained on real SQLi/XSS and benign query strings, then evaded by finding and exploiting the single character n-gram the model learned to associate most strongly with benign, dropping its malicious score from 0.9594 to 0.2836.
A real MLPClassifier poisoned with a small cluster of mislabelled chaff points via partial_fit, and why any system that retrains automatically on live, unvetted data carries this exact exposure, the same mechanism behind the 2016 Microsoft Tay incident.
The field's standard public intrusion-detection benchmarks, NSL-KDD's fix for KDD Cup 99's redundant-record problem, CICIDS2017's modern realism, UNSW-NB15 as a third current benchmark, and why a benchmark dataset is not a production dataset.
Scoring incoming indicator-of-compromise reports for relevance with the same TF-IDF pattern from Unit 5, a five-step daily triage pipeline, and why automation changes what an analyst spends their day on rather than replacing them.
A one-page summary table of every topic in this unit and the whole course, seven self-study questions to test understanding, and a lab exercise finding a production decision threshold from a precision-recall curve.
Assessments
ML for Cyber Security: Complete Assessment
Start final exam →