A training dataset is a collection of labeled records used to supervise a machine-learning model’s learning. Its labels are the correct answers the model should learn to predict; for DNS traffic, they can distinguish tunneled traffic from normal traffic. A sufficiently and correctly labeled dataset is often called ground truth. section 9.2
The dataset supplies the model’s features as well as its answers, so its content directly affects the resulting model. For example, a model trained on DNS data collected during a weekend can differ from one trained on working-day data, even when the algorithm and parameters are unchanged. section 9.2
Prepare a training dataset as an operational asset, not a one-time file:
- Acquire data that is relevant to the detection problem and has reliable labels. section 9.2
- Confirm that its features are available in production data. section 9.2
- Decide whether it has enough records and whether each class is adequately represented. section 9.2 section 9.2.5
- Keep it current and plan retraining when new training data is needed. section 9.2
DNS-tunneling training set
For a supervised threat-hunting model, labeled DNS queries and responses form the training dataset. The model learns from records marked tunneled or normal, then predicts whether later DNS activity resembles regular traffic or DNS tunneling used for data exfiltration or command-and-control communication. section 9.0 section 9.2
Keep a separate labeled test dataset to evaluate the model rather than training and evaluating on the same records. One demonstrated starting split assigns 80% of 20,001 data points to training and 20% to testing, then checks whether both subsets have balanced class distributions. section 9.2.5 section 9.2.5
Listing 9.12 Splitting df_orig_selected
from sklearn.model_selection import train_test_split #1
X = df_orig_selected.drop(‚class', axis=1) #2
y = df_orig_selected['class'] #3
X_train, X_test, y_train, y_test = \
train_test_split(X, y, test_size=0.2, random_state=42 #4
This split separates feature columns from the class label, then uses train_test_split to create training and testing subsets with 20% reserved for testing. section 9.2.5
