AI applications in
Cybersecurity

Block 0 – Cyber-AI Startup and Context  

Introduction to the working environment: Python (scikit-learn, pandas, numpy) and Google Colab. Limitations of Traditional Security: The problem of the volume, speed and variety of threats (signatures vs. behavior). 

AI Opportunities: Proactive detection, behavioral analysis, automated response.  

Taxonomy of Problems: Problem Identification (Intrusion, Malware, Phishing, Fraud)  

Block 1 – Specific Data and Preprocessing

Identification of public dataset sources (CIC-IDS2017, NSL-KDD, etc.) and structure of their content according to each type of problem. 

Preprocessing Techniques: Encoding (One-Hot, Label), Scaling (StandardScaler, MinMaxScaler).

 Class Imbalance Management: The problem of "attacks" vs. "normal traffic". 

Synthetic Data Generation: Oversampling techniques (e.g., SMOTE) to balance fraud or intrusion datasets. 

Block 2 – Supervised Learning (Detection of Known Threats)  

Fundamentals of Classification: Logistic Regression, Decision Trees.  

Robust Models: Random Forest and Gradient Boosting (XGBoost) for high accuracy. Practical Case 1: Malware Detection Using static features for binary classification (benign vs. malicious). 

Practical Case 2: Phishing Detection Classification of URLs or emails based on their characteristics (lexical, structural).

Block 3 – Unsupervised Learning (Detection of Anomalies) (10 h) 

Clustering Algorithms: K-Means, to find groups of similar behavior. Specific Anomaly Detection Algorithms: Isolation Forest and One-Class SVM. 

Practical Case: Intrusion Detection Identifying network traffic that deviates from learned "normal" behavior. 

Practical Case: Behavior Analysis Modeling of a user's baseline and detection of deviations (e.g., anomalous access).  

Block 4 – Evaluation, Ethics and Challenges  

Validation Strategies: Train/Test split and Cross Validation (K-Fold). 

Key Metrics in Cybersecurity: 

The Tyranny of Accuracy: Why accuracy is a misleading metric. 

Confusion Matrix: The cost of False Positives (blocking a legitimate user) vs. False Negatives (allowing an attack). 

Accuracy, Recall, F1-Score and ROC/AUC Curve. 

Ethics, Biases, and Privacy: 

Privacy in data analysis (e.g., network traffic). 

Biases in datasets  

Block 5 – Integrative Project (Case Study)  

Problem Formulation: Selecting a Use Case  

Dataset Selection and Documentation: Searching for and justifying the dataset to be used. End-to-End Pipeline Development: 

Loading and preprocessing  

Model selection and training  

Robust evaluation with appropriate metrics  

Results Analysis: Interpretation of the confusion matrix and justification of the model choice.