ML for Cyber Security
ML for Cyber Security
Sign in to save your progress, earn points, and unlock module exams.
Unit 3 of MLCS
k-Means and DBSCAN clustering, dimensionality reduction with PCA and t-SNE, purpose-built anomaly detectors like isolation forest, and a full intrusion detection case study built on real data.
Why intrusion detection leans so heavily on unsupervised learning when no security team can label every network flow, and the distinct but related goals of clustering and anomaly detection.
The four-step k-means algorithm, a runnable scikit-learn example clustering standardised network-flow features, a real chart showing three clusters plus unclustered scan-burst outliers, and why k-means needs both a chosen k and scaled features.
Density-based clustering that needs no pre-chosen k, discovers arbitrarily shaped clusters, and explicitly flags sparse, isolated points as noise, the built-in outlier flag a security analyst actually wants.
Why the curse of dimensionality hurts algorithms like k-means on wide feature tables, PCA's fast and meaningful projection onto directions of greatest variance, t-SNE's visually cleaner but non-metric alternative, and a real side-by-side comparison on an NSL-KDD-style dataset.
Isolation Forest, One-Class SVM and Local Outlier Factor, three algorithms built specifically to answer how anomalous a single point is, each with a different notion of unusual, and the outlier-versus-novelty mode distinction a production IDS actually needs.
Loading the real 1999 KDD Cup dataset directly through scikit-learn, discovering its unrealistic 80 percent attack rate, resampling to a realistic 3 percent, and the honest, unflattering real result of running Isolation Forest out of the box: 95.7 percent accuracy but only 28 percent precision and recall on actual attacks.
How User and Entity Behavior Analytics products score an event by how rare it is for the specific user or host involved, a minimal runnable rarity scorer, and the Darktrace-style case study of unsupervised baselining in commercial network defence.
A one-page summary table of every topic in this unit, seven self-study questions to test understanding, and a lab exercise tuning DBSCAN's eps parameter and comparing it against k-means.
Assessments
ML for Cyber Security: Complete Assessment
Start final exam →