Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

Signature- and static-IOC-based rules routinely miss fileless intrusions, living-off-the-land binaries (LOLBins) and encrypted command-and-control (C2) channels. This course teaches how to engineer behavioural threat detection models across endpoint (Sysmon/EDR), network (NetFlow/Zeek/DNS) and cloud (CloudTrail/Entra ID) telemetry and map detections to MITRE ATT&CK tactics.

Participants build models that detect malicious process trees and command-line sequences, identify C2 beaconing from encrypted traffic metadata, and apply evasion-resistant feature engineering against adversary obfuscation.

Who Should Attend?

  • Detection engineering and threat hunting teams
  • Data scientists and ML engineers building EDR/NDR/XDR and security analytics models
  • Senior SOC engineers and cybersecurity researchers
  • Prerequisite: Python ML/data analysis experience and familiarity with OS/network telemetry (Sysmon, DNS, HTTP)

Key Takeaways

  • Engineer resilient behavioural features at the top of the Pyramid of Pain aligned with MITRE ATT&CK
  • Train malware and LOLBin abuse detectors on static binary attributes and process/command-line telemetry
  • Detect C2 beaconing and DNS/HTTPS data exfiltration from Zeek and NetFlow time-series metadata
  • Correlate weak individual signals over an attack graph to surface multi-stage intrusion campaigns
  • Test and harden detection models against command-line obfuscation and low-and-slow evasion techniques

Curriculum

Behavioural Threat Detection and the Pyramid of Pain
  • Moving from hashes and IPs to behavioural TTP models; combining deterministic Sigma rules with ML
  • Handling label scarcity, delayed ground truth and extreme class imbalance in security telemetry
Endpoint (EDR/Sysmon) and Malware Detection
  • Static PE analysis with EMBER/LIEF and fast gradient-boosted malware classification
  • Detecting LOLBin abuse and ransomware from PowerShell, shell and process-tree sequences using token embeddings
Network Telemetry (NDR) and Encrypted Traffic Analysis
  • Detecting C2 beaconing via JA4/TLS fingerprints, packet-size distributions and inter-arrival periodicity
  • Models for catching DNS tunnelling and low-rate data exfiltration
Cloud Identity Threats and Attack Graph Correlation
  • Identifying impossible travel, token theft and privilege escalation in Entra ID, Okta and AWS CloudTrail
  • Correlating endpoint, identity and network signals on a graph to uncover lateral movement chains
Adversarial Evasion of Detectors and Production Operations
  • Testing detector resilience against command obfuscation, binary padding and beacon jitter
  • Generating SHAP-based analyst explanations and monitoring for telemetry concept drift

Other Courses in This Category

  • Anomaly Detection with Machine Learning for Security and Operations

    Teaches how to build unsupervised and semi-supervised anomaly detection pipelines on logs, network traffic and user behaviour (UEBA) using Isolation Forests, Autoencoders, time-series and graph methods while minimising false positives.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • AI-Powered SIEM and Modern SOC Operations

    Teaches how to integrate LLM assistants, natural-language-to-KQL/SPL query generation, automated alert enrichment, triage agents and incident summarisation safely into SIEM, SOAR and modern SOC operations.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • AI and Machine Learning Model Security Fundamentals

    Covers model extraction, membership inference, model inversion, poisoning and evasion attacks against machine learning and deep learning models using the MITRE ATLAS framework, along with practical defenses.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • Adversarial Machine Learning: Evasion Attacks and Robustness Defenses

    Hands-on training on FGSM, PGD, Carlini & Wagner, AutoAttack and black-box evasion attacks using the IBM Adversarial Robustness Toolbox (ART), paired with adversarial training and certified robustness defenses.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • AI Data Poisoning and Backdoor Attacks in Training and Fine-Tuning

    Teaches how to detect and prevent label flipping, clean-label poisoning and hidden backdoor/trojan attacks in training and fine-tuning datasets using spectral signatures, activation clustering and data sanitisation.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • Deep Learning Model Security: Architectures, Weights and Inference Protection

    In-depth training on protecting vision, audio, biometric and multimodal deep neural networks against weight and architecture theft, feature reconstruction, sponge latency attacks and inference-layer compromises.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View

Get in touch