Machine Learning for CybersecuritySource on GitHub

A free course on applying machine learning to security problems and on securing machine learning itself

Machine Learning for Cybersecurity

Dr. Ali Al Bataineh, Higher Colleges of Technology, United Arab Emirates

This is a free course on two related subjects. The first is how machine learning is applied to security problems, such as detecting intrusions, malware, phishing and fraud. The second is how machine learning systems themselves are attacked and defended, from adversarial examples and poisoned training data to deepfakes and prompt injection against language models.

Units 1 to 11 each have three lessons with the mathematics, worked examples and references, one or more labs that run in a browser on Google Colab or on a laptop CPU, exercises with worked solutions, and a self-check quiz, and Unit 12 is a guide to a project of your own. Eight of the nineteen labs use a synthetic network dataset built for the course, and every number quoted from a lab comes from a notebook that you can run again yourself.

Why I made this course

I believe knowledge should be shared, and that no one should have to pay to learn.

Security teams are being asked to adopt machine learning, and attackers have started to use it as well. Much of the material that teaches both sides properly is spread across paid courses and papers behind paywalls. Someone studying at a small college, or an analyst whose organization has no training budget, should be able to learn it to the same depth as anyone else.

I wrote this course so that they can, at no cost. The labs run in a free browser notebook, every lab result quoted in the text comes from code you can run yourself, and claims that are not common knowledge cite their sources. Nothing here needs a GPU or a paid service. To run the labs, the only account you may want is a free Google account for Colab, and you can also run every lab on your own computer.

If it helps you, share it with someone who is starting out. If you find a mistake, please tell me by opening an issue on GitHub, so that the next reader learns it correctly.

Ali Al Bataineh

Contents

Foundations

  1. Machine learning meets securityWhat machine learning can and cannot do for a security team, why rare attacks make accuracy meaningless, and the dataset used through the course.
  2. Data, leakage and evaluationPreparing security data, splitting it so that the test resembles deployment, and choosing a threshold from an alert budget.
  3. Supervised learningLinear models trained by gradient descent, distance and kernel methods, probabilistic classifiers and tree ensembles, applied to intrusion and phishing detection.
  4. Unsupervised learning and anomaly detectionClustering, principal component analysis and anomaly detectors, and why an unusual connection is not necessarily a malicious one.

Deep learning

  1. Neural networksBackpropagation worked by hand, training neural networks in practice, and autoencoders for anomaly detection.
  2. Convolutional, sequence and reinforcement learning modelsConvolutional networks and transfer learning, sequence models for system logs, and reinforcement learning for attack and defense planning.

Attacking and defending machine learning

  1. Adversarial examples and evasionThreat models for machine learning, gradient attacks such as FGSM and PGD, and how to evaluate robustness so that the result can be trusted.
  2. Poisoning, privacy and defensesPoisoning and backdoors, model extraction and membership inference, and the defenses that hold up: adversarial training and differential privacy.

Generative AI and governance

  1. Deepfakes and synthetic mediaHow synthetic images, video and voice are made, why detectors fail on generators they have not seen, and what provenance and process can do instead.
  2. Security of language models and agentsHow language models work from a security reader's point of view, prompt injection and jailbreaks, and securing retrieval systems, agents and the model supply chain.
  3. Governance, fairness and accountabilityRisk management frameworks and regulation, fairness when error rates differ between groups, and documenting a model so others can audit it.

Project

  1. Capstone projectPlan, run and report a project of your own, using the evaluation checklist from the whole course.