# ML for Security

> Machine learning for security: malware classification, intrusion detection with autoencoders, adversarial evasion, and binary similarity.

- Source: https://stevenfoerster.com/tutorials/paths/ml-for-security/

Learning Path

Apply machine learning to security problems with explicit baselines and constraints: gadget ranking, network anomaly detection, adversarial evasion, binary similarity, temporal validation, and model operations.

9 available [Start the path](https://stevenfoerster.com/tutorials/anomaly-detection-on-linux-audit-logs-with-isolation-forest/)

1.  - 1
    - intermediate

    ## [Anomaly Detection on Linux Audit Logs](https://stevenfoerster.com/tutorials/anomaly-detection-on-linux-audit-logs-with-isolation-forest/)

    Build a lightweight anomaly detection pipeline that flags suspicious Linux sessions using auditd logs, feature engineering, and scikit-learn; no GPU required.

2.  - 2
    - advanced

    ## [Training a ROP Gadget Classifier with XGBoost](https://stevenfoerster.com/tutorials/training-a-rop-gadget-classifier-with-xgboost/)

    Build a machine learning classifier that predicts whether a ROP gadget is useful for exploit chains, using features extracted from x64 disassembly and XGBoost.

3.  - 3
    - intermediate

    ## [Network Intrusion Detection with Autoencoders](https://stevenfoerster.com/tutorials/network-intrusion-detection-with-autoencoders/)

    Build a PyTorch autoencoder trained only on normal network flows to detect intrusions as high-reconstruction-error outliers, and compare with Isolation Forest.

4.  - 4
    - advanced

    ## [Phishing URL Detection with Fine-Tuned Transformers](https://stevenfoerster.com/tutorials/phishing-url-detection-with-fine-tuned-transformers/)

    Fine-tune a DistilBERT model to classify phishing vs legitimate URLs, compare against a TF-IDF baseline, and explore tokenization challenges with URL strings.

5.  - 5
    - advanced

    ## [DNS Exfiltration Detection with Sequence Models](https://stevenfoerster.com/tutorials/dns-exfiltration-detection-with-sequence-models/)

    Build an LSTM that detects DNS tunneling and data exfiltration by analyzing sequences of DNS queries, and compare against a per-query feature baseline.

6.  - 6
    - advanced

    ## [Adversarial Evasion of ML Security Classifiers](https://stevenfoerster.com/tutorials/adversarial-evasion-of-ml-security-classifiers/)

    Attack a differentiable malware-feature classifier, measure evasion under explicit constraints, and evaluate adversarial training as one defense.

7.  - 7
    - advanced

    ## [Encrypted Traffic Classification](https://stevenfoerster.com/tutorials/encrypted-traffic-classification/)

    Classify application types and detect malicious channels in TLS-encrypted traffic using only flow metadata, with a 1D CNN and a gradient boosting baseline.

8.  - 8
    - advanced

    ## [Threat Intelligence Extraction with Named Entity Recognition](https://stevenfoerster.com/tutorials/threat-intelligence-extraction-with-ner/)

    Fine-tune a BERT token classifier to extract IOCs, threat actors, and techniques from security reports, then wrap it in a structured extraction function.

9.  - 9
    - advanced

    ## [Binary Function Similarity with Graph Neural Networks](https://stevenfoerster.com/tutorials/binary-function-similarity-with-graph-neural-networks/)

    Represent disassembled functions as control flow graphs, train a graph neural network for similarity embeddings, and apply it to patch diffing.


[All tutorials and learning paths](https://stevenfoerster.com/tutorials/)