Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

Zero-day intrusions, insider threats and novel abuse patterns rarely exist in historical labelled datasets—yet naively deployed unsupervised anomaly detectors flood teams with alerts on every unusual but benign event. This course focuses on engineering low-false-positive anomaly detection systems across high-volume security and operational data.

Using PyOD, scikit-learn and PyTorch, participants implement dynamic user and peer-group profiling (UEBA), Isolation Forest/ECOD, Autoencoder reconstruction models and time-series anomaly detectors, complete with threshold calibration and ensemble scoring.

Who Should Attend?

  • Data scientists working on security analytics, UEBA, fraud detection and operational monitoring
  • Machine learning and data engineers
  • SIEM/SOC analytics and detection specialists
  • Prerequisite: Python (pandas, scikit-learn) and foundational probability and statistics

Key Takeaways

  • Select the right algorithm family for point, contextual and collective anomalies
  • Engineer behavioural UEBA features normalized against individual history and peer groups
  • Apply Isolation Forest, LOF, ECOD and COPOD to high-dimensional log data using PyOD
  • Detect sequential event and traffic anomalies with deep Autoencoders and time-series models
  • Calibrate alert thresholds, combine ensemble scores and incorporate analyst feedback to suppress false positives

Curriculum

Anomaly Taxonomy and Core Challenges in Security Data
  • Point, contextual and collective anomalies: why statistical outliers do not automatically equal attacks
  • Handling seasonality, business hours, maintenance windows and the base-rate fallacy
Behavioural Feature Engineering and Peer Grouping for UEBA
  • Rolling-window aggregations, categorical rarity scores and first-time event indicators
  • Normalising behaviour against both individual history (self-baseline) and role/peer-group baselines
Unsupervised and Semi-Supervised ML Algorithms (PyOD)
  • Comparing Isolation Forest, Local Outlier Factor (LOF), One-Class SVM, ECOD and COPOD
  • Leveraging scarce confirmed incidents with semi-supervised methods (DeepSAD / XGBOD) and active learning
Deep Learning, Time-Series and Log Sequence Anomalies
  • Multivariate anomaly detection via Autoencoder and Variational Autoencoder (VAE) reconstruction error
  • Time-series decomposition (STL) and log template sequence anomaly detection (Drain / DeepLog)
Score Aggregation, Threshold Calibration and Concept Drift
  • Aggregating weak signals into an entity risk score and calibrating thresholds with Extreme Value Theory (POT)
  • Monitoring distribution drift (PSI / KS tests), scheduling retraining and explaining root features to analysts

Other Courses in This Category

  • AI-Powered SIEM and Modern SOC Operations

    Teaches how to integrate LLM assistants, natural-language-to-KQL/SPL query generation, automated alert enrichment, triage agents and incident summarisation safely into SIEM, SOAR and modern SOC operations.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • AI and Machine Learning Model Security Fundamentals

    Covers model extraction, membership inference, model inversion, poisoning and evasion attacks against machine learning and deep learning models using the MITRE ATLAS framework, along with practical defenses.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • Adversarial Machine Learning: Evasion Attacks and Robustness Defenses

    Hands-on training on FGSM, PGD, Carlini & Wagner, AutoAttack and black-box evasion attacks using the IBM Adversarial Robustness Toolbox (ART), paired with adversarial training and certified robustness defenses.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • AI Data Poisoning and Backdoor Attacks in Training and Fine-Tuning

    Teaches how to detect and prevent label flipping, clean-label poisoning and hidden backdoor/trojan attacks in training and fine-tuning datasets using spectral signatures, activation clustering and data sanitisation.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • Deep Learning Model Security: Architectures, Weights and Inference Protection

    In-depth training on protecting vision, audio, biometric and multimodal deep neural networks against weight and architecture theft, feature reconstruction, sponge latency attacks and inference-layer compromises.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View
  • MLOps Security and DevSecOps for Machine Learning Pipelines

    Teaches how to secure the end-to-end MLOps lifecycle—across data pipelines, Jupyter workspaces, MLflow, Kubeflow, model registries, CI/CD and KServe/Kubernetes serving—using Sigstore/Cosign, ModelScan and Zero Trust controls.

    Model Security & AI in Cybersecurity Corporate
    Live Course
    5 modules
    View

Get in touch