Machine learning lets computers learn from data and improve at tasks without receiving fixed rules. An algorithm processes records to produce a model, which can predict or identify similarities. section 8.1
For threat hunting, machine learning reverses explicit detection logic: data reveals patterns and anomalies that may deserve investigation. Unsupervised learning finds hidden structures without predefined labels. section 8.0 section 8.1
A practical machine-learning investigation follows a repeatable path:
- Understand and process the source data before attempting to build a model. section 8.0 section 8.1
- Transform records into useful features, selecting relevant fields and encoding non-numeric values when necessary. section 8.0
- Apply an unsupervised algorithm such as k-means to generate a model from the prepared data. section 8.0 section 8.1
- Interpret the model’s outputs as clues, then investigate anomalies for possible malicious activity. section 8.0
Beaconing to a trusted destination
A threat hunter can use unsupervised learning to examine network connection events for anomalies in suspected beaconing. Example signals include 845 exchanged bytes and TLS client-proposed cipher suites that differ from legitimate Dropbox connections. section 8.1
Figure 8.1 Threat hunting with unsupervised machine process
Use the process diagram to connect data preparation, feature construction, model building, and threat-hunting interpretation. section 8.0
