Supervised learning

As explained in Cyber Threat Hunting

Supervised machine learning learns a mapping from labeled examples to predictions or decisions.

Supervised learning builds a model from labeled examples so it can predict a label for new records. In DNS threat hunting, the prediction can distinguish normal traffic from DNS tunneling; labels such as tunneled and normal provide the ground truth for learning. section 9.2

Its value depends heavily on the training set. Features used for training must match those submitted in production, and labels, recency, relevance, and class balance all affect whether predictions will be useful. Training data also needs maintenance and periodic retraining as conditions change. section 9.2 section 9.2.1

Use supervised learning for a threat-hunting investigation in a repeatable sequence:

• Collect and process relevant events, such as DNS queries and responses from endpoints. section 9.0 section 9.1
• Acquire or build labeled examples whose features are available in the production data. section 9.2 section 9.2.1
• Train a model on the features and labels, then use it to identify initial clues for investigation. section 9.0 section 9.2
• Evaluate whether the preparation and maintenance cost makes supervised learning the appropriate analytical tool. section 9.7

DNS tunneling classification

A labeled DNS data set can separate regular domain names from traffic generated by dns2tcp, dnscapy, Iodine, and tuns. These tunneling classes may be preserved for finer classification or combined into one tunneling label for a binary normal-versus-tunneled prediction. section 9.2.1

Figure 9.2 The process of threat hunting with supervised ML

Use the process diagram to orient data processing, training-set preparation, model learning, and prediction within a supervised threat-hunting workflow. section 9.2

How Cyber Threat Hunting covers it

How deep it goes

Defines labels, ground truth, features, and training-data constraints while treating Random Forest and XGBoost only at a high level.

Examples

Uses Zeek DNS events and a labeled domain-name data set containing regular traffic and four tunneling-tool classes.

What it assumes

Assumes processed event data and teaches the added need for acquiring, labeling, and maintaining training sets.

What you can do after

Apply it via Random Forest or XGBoost to investigate DNS tunneling when reliable labeled data is available.

How it connects

Connects training sets, labels, ground truth, features, DNS tunneling, Random Forest, XGBoost, and unsupervised learning.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Optimization Algorithms: AI techniques for design, planning, and control problemsSupervised learning is a machine-learning paradigm in which a model learns mappings from inputs to labeled target outputs.
• 

  liveBookmanning.com
  Causal Inference for Data ScienceSupervised learning is a machine-learning approach that learns a mapping from inputs to labeled outputs.
• 

  liveBookmanning.com
  Financial AI in PracticeSupervised learning trains models on labeled examples to predict outputs for new inputs.
• 

  liveBookmanning.com
  Investing for ProgrammersA machine-learning approach that trains a model from examples paired with known target outcomes.
• 

  liveBookmanning.com
  Grokking AI ApplicationsSupervised learning is a machine learning approach that learns to predict outcomes from labeled examples.
• 

  liveBookmanning.com
  Math and Architectures of Deep LearningA learning setting where training examples include known target outputs used to guide parameter estimation.
• 

  liveBookmanning.com
  Data Without LabelsSupervised learning is a machine-learning paradigm in which models learn from input data paired with desired outputs to predict outputs for unseen data.
• 

  liveBookmanning.com
  Grokking Machine LearningA machine-learning approach that learns from labeled data to predict labels for previously unseen data.
• 

  liveBookmanning.com
  The AI Pocket BookA machine-learning approach where the model learns from labeled examples showing the desired task behavior.
• 

  liveBookmanning.com
  The Art of AI Product DevelopmentSupervised learning is machine learning in which a model learns a mapping from inputs to explicitly labeled targets.
• 

  liveBookmanning.com
  Outlier Detection in PythonA machine learning paradigm in which models learn from data accompanied by labels.
• 

  liveBookmanning.com
  Classic Computer Science Problems in Swift: Essential techniques for practicing programmersSupervised learning is a machine-learning approach that learns from inputs paired with known target outputs.
• 

  liveBookmanning.com
  Machine Learning Algorithms in DepthA machine learning algorithm that learns from examples pairing inputs with desired outputs.
• 

  liveBookmanning.com
  Learn AI-Assisted Python Programming, Second EditionSupervised learning is a machine-learning approach that learns from examples paired with categories or target outputs.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecuritySupervised learning is a machine-learning approach that trains an algorithm on examples paired with known labels.
• 

  liveBookmanning.com
  Introduction to Generative AI, Second EditionSupervised learning is machine learning in which training examples include desired outputs or labels.
• 

  liveBookmanning.com
  Advanced Algorithms and Data StructuresSupervised learning is machine learning in which a model is trained from examples paired with labels or target values.
• 

  liveBookmanning.com
  Statistics Every Programmer NeedsSupervised learning is a machine-learning approach that learns a mapping from inputs to known target outcomes using labeled examples.

Compare how 19 books explain supervised learning →

Related concepts

• machine learningkind of · Machine learning is a field of computational methods in which systems learn patterns or relationships from data to make predictions, decisions, or other outputs.
• unsupervised learningcontrasts with · Unsupervised learning is a machine-learning approach that discovers patterns, structure, or representations in data without labeled target outputs.
• labeled datauses · Labeled data is a set of examples or observations paired with target values, categories, or other task-relevant annotations.
• reinforcement learning with human feedbackused by · Reinforcement learning with human feedback is a model-training approach that uses human evaluations or preferences to guide optimization of model behavior.
• classifierincludes · A classifier is a predictive computational model that assigns inputs to one or more discrete classes or categories.
• linear regressionincludes · Linear regression is a statistical modeling method that estimates a continuous response as a linear combination of predictor variables and fitted coefficients.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.