Hands-On Artificial Intelligence for Cybersecurity

Classifying suspicious user activity

Once we have accumulated the necessary features to feed our datasets, we need to decide on what kind of strategy to follow in order to train our algorithms. In particular, the approach that is spontaneously adopted is that of supervised learning, and that is done by leveraging the information that's already in our possession and exploiting the previous classifications we made of accounts deemed to be suspicious. In fact, we could have already accumulated a number of user accounts in our blacklists, or reported them as suspicious using rule-based detection systems.

As examples of positive training, we could consider the features associated with suspended or blacklisted accounts, whereas we could consider ...