Learning Path

ML for Security

Apply machine learning to security problems with explicit baselines and constraints: gadget ranking, network anomaly detection, adversarial evasion, binary similarity, temporal validation, and model operations.

9 available Start the path
  1. 1 intermediate

    Anomaly Detection on Linux Audit Logs

    Build a lightweight anomaly detection pipeline that flags suspicious Linux sessions using auditd logs, feature engineering, and scikit-learn; no GPU required.

  2. 2 advanced

    Training a ROP Gadget Classifier with XGBoost

    Build a machine learning classifier that predicts whether a ROP gadget is useful for exploit chains, using features extracted from x64 disassembly and XGBoost.

  3. 3 intermediate

    Network Intrusion Detection with Autoencoders

    Build a PyTorch autoencoder trained only on normal network flows to detect intrusions as high-reconstruction-error outliers, and compare with Isolation Forest.

  4. 4 advanced

    Phishing URL Detection with Fine-Tuned Transformers

    Fine-tune a DistilBERT model to classify phishing vs legitimate URLs, compare against a TF-IDF baseline, and explore tokenization challenges with URL strings.

  5. 5 advanced

    DNS Exfiltration Detection with Sequence Models

    Build an LSTM that detects DNS tunneling and data exfiltration by analyzing sequences of DNS queries, and compare against a per-query feature baseline.

  6. 6 advanced

    Adversarial Evasion of ML Security Classifiers

    Attack a differentiable malware-feature classifier, measure evasion under explicit constraints, and evaluate adversarial training as one defense.

  7. 7 advanced

    Encrypted Traffic Classification

    Classify application types and detect malicious channels in TLS-encrypted traffic using only flow metadata, with a 1D CNN and a gradient boosting baseline.

  8. 8 advanced

    Threat Intelligence Extraction with Named Entity Recognition

    Fine-tune a BERT token classifier to extract IOCs, threat actors, and techniques from security reports, then wrap it in a structured extraction function.

  9. 9 advanced

    Binary Function Similarity with Graph Neural Networks

    Represent disassembled functions as control flow graphs, train a graph neural network for similarity embeddings, and apply it to patch diffing.

All tutorials and learning paths