The Normal Case Is Unlabelled

Why intrusion detection leans so heavily on unsupervised learning when no security team can label every network flow, and the distinct but related goals of clustering and anomaly detection.

~5 min total·4 quadrants of structured content

By the end of this topic, you will

Explain why intrusion detection relies on unsupervised learning rather than labelled classification
Distinguish clustering from anomaly detection as two related but distinct goals
Give an example of a point that could be both the member of its own cluster and an anomaly

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Video content coming soon.

Quadrant 2 · e-Content

Articles and case studies

The Normal Case Is Unlabelled

No security team can label every network flow crossing a large enterprise network every second. Intrusion detection has to ask a different question: does this resemble the traffic I have already seen, or does it stand apart?

Quadrant 3 · Web Resources