A decision tree classifies data through a sequence of feature-based questions. Decision nodes split the analysis, branches represent possible paths, and leaf nodes provide the resulting classification. The path from root to leaf turns a complex decision into simpler, sequential choices. section 12.3.1
Threat detection
For incoming network traffic, a tree can ask whether an email sender is trusted, whether traffic volume is unusual, or whether login attempts are suspicious. A final leaf can classify the activity as safe or a potential threat. Random forest extends this idea by combining multiple decision trees when classifying benign and malicious traffic. section 12.3.1
Figure 12.3 Elements of a decision tree
Use the figure to identify the root, decision nodes, branches, and leaf outcomes in a tree structure. section 12.3.1












