A support vector machine (SVM) is a supervised-learning model that separates classes by constructing a boundary from patterns in labeled data. In cybersecurity, it can distinguish safe activity from threats such as phishing, malware, or malicious network traffic. section 12.3
The model treats classification as a separation problem: it draws a boundary between normal and dangerous observations using features such as email attributes, IP addresses, traffic volume, login times, or failed-login attempts. That boundary supports decisions about which activity deserves investigation. section 12.3 section 12.3.1
Classifying suspicious login activity
A small exercise labels login activity as malicious when the login occurs after 20:00 or includes more than five failed attempts. After the data is cleaned and split into training and testing sets, an SVM classifies unseen activity. The reported SVM accuracy is 0.87, with 0.79 recall for normal activity and 0.94 recall for malicious activity. Security teams can use these results to prioritize suspicious events, while comparing performance with another model before operational adoption. section 12.3.1
