5. Unsupervised Learning and Behavioral Analytics

Introduction and Context

Cybersecurity monitoring traditionally depends on known indicators: malicious IP addresses, malware signatures, exploit patterns, and rules derived from previous incidents. Such controls remain essential, but they are weakest when the threat is new, deliberately disguised, or generated by a legitimate account. A compromised employee account may authenticate successfully, use approved software, and access valid systems. A zero-day exploit may produce no recognizable signature. An insider may behave within technical permissions while violating organizational trust. These situations require a different analytical perspective: instead of asking whether an event matches a known attack, security analysts ask whether the event is unusual in its context and whether it represents a meaningful change in behavior.

Unsupervised learning supports this perspective. It identifies structure in data without requiring a complete set of labelled attack examples. In cybersecurity, it is used to group similar entities, reduce high-dimensional telemetry to interpretable patterns, estimate normal behavioral density, and detect observations that are distant from or inconsistent with established patterns. These capabilities form an important foundation for User and Entity Behavior Analytics (UEBA).

The value of unsupervised learning is not that every unusual event is malicious. Most anomalies are benign: a new project, an emergency maintenance task, a business trip, or a software upgrade can change behavior. The professional task is therefore not simply anomaly detection, but contextual interpretation, risk prioritization, investigation, and controlled response. This chapter examines the methods and reasoning required to use unsupervised learning responsibly in cybersecurity operations.

Learning Objectives

After studying this chapter, a student should be able to:

1. Explain the role of unsupervised learning in cybersecurity and distinguish it from supervised and semi-supervised learning.

2. Apply clustering methods to users, devices, applications, and other security entities.

3. Explain how dimensionality reduction supports visualization, noise reduction, and behavioral modelling.

4. Compare statistical, distance-based, density-based, and isolation-based anomaly detection approaches.

5. Design a practical UEBA workflow for detecting insider threats, compromised accounts, and previously unseen attack activity.

6. Interpret model results using contextual evidence rather than treating anomaly scores as proof of compromise.

7. Evaluate operational, ethical, privacy, governance, and technical risks in behavioral analytics systems.

From Event Records to Behavioral Profiles

A security event is meaningful only in relation to an entity, a time period, and a context. An authentication record may contain a user identifier, source address, device, authentication method, timestamp, result, and application. A file-access record may include the user, resource classification, action, volume, and transfer destination. To perform behavioral analytics, individual events are transformed into features that describe activity over a defined observation window.

For a user, features may include the number of logins, percentage of logins outside normal working hours, number of distinct countries or network zones, privileged commands, applications used, files accessed, data transferred, and deviations from the user’s historical baseline. For a device, useful features may include the number of users, destinations contacted, executable files observed, failed authentication attempts, and unusual administrative activity. Features can be categorical, numerical, temporal, binary, or sequential. The quality of this representation often matters more than the sophistication of the algorithm.

A behavioral profile is not a permanent identity label. It is a probabilistic description of activity under particular conditions. A user who normally works from one office may legitimately travel. A service account may show high-volume activity that is normal for its function but abnormal for a human account. Consequently, profiles should be segmented by role, location, shift, device type, business calendar, and operational context whenever those variables are relevant.

Unsupervised, Supervised, and Semi-Supervised Learning

Supervised learning uses labelled examples, such as confirmed phishing sessions and benign sessions, to learn a classification boundary. Its performance depends on the quality, representativeness, and currency of the labels. In cybersecurity, confirmed attack data are often scarce and biased toward incidents that have already been discovered.

Unsupervised learning works without target labels. It seeks clusters, latent structure, density variations, or isolated observations. It is useful for discovering previously unknown patterns, but the output normally requires human interpretation. Semi-supervised approaches use a small quantity of labelled data together with a larger unlabelled population. In practice, security platforms frequently combine all three approaches: signatures and supervised classifiers identify known threats, while unsupervised models discover deviations and generate investigative leads.

Clustering as a Behavioral Lens

Clustering partitions or organizes observations according to similarity. In a UEBA system, an observation may represent a user-day, device-day, session, process, or sequence of actions. Similarity is determined by a distance or affinity function over the selected features.

K-Means and Centroid-Based Grouping

K-means assigns observations to a predefined number, k, of clusters. It alternates between assigning each observation to the nearest centroid and recalculating centroids until the assignments stabilize. The usual objective minimizes the sum of squared distances between observations and their assigned centroids.

K-means is computationally efficient and easy to explain. It can reveal groups such as standard office users, developers, administrators, and automated service accounts. However, it assumes that clusters are reasonably compact and that numerical distance is meaningful. It is sensitive to scale and outliers, and the choice of k is not always obvious. A cluster containing privileged administrators may be small but operationally important; reducing the problem to cluster size would be misleading.

Feature standardization is therefore essential when variables have different units. Without scaling, a feature such as daily bytes transferred may dominate a binary feature such as use of a privileged command. The analyst should also consider robust scaling when extreme values are expected.

Hierarchical Clustering

Hierarchical clustering constructs a tree of nested groups. Agglomerative methods begin with each observation as a separate group and progressively merge the closest groups. The resulting dendrogram can be cut at different levels, allowing analysts to examine behavior at multiple granularities. This is useful when the number of natural groups is unknown or when organizational roles form a hierarchy of similarity.

The method can be computationally expensive for very large datasets. Its results also depend on the linkage rule, such as single, complete, average, or Ward linkage. A dendrogram should be treated as an exploratory representation rather than an unquestionable organizational taxonomy.

Density-Based Clustering

Density-based methods, such as DBSCAN, define clusters as regions containing sufficiently dense observations separated by sparse regions. They can identify irregularly shaped groups and explicitly mark some observations as noise. This property is attractive in cybersecurity, where suspicious activity may not form a compact spherical cluster.

DBSCAN requires parameters controlling neighborhood size and minimum density. A single parameter setting may not suit both highly active administrators and low-volume users. HDBSCAN extends the density-based idea by supporting variable density and producing a hierarchy of clusters, making it useful when behavioral populations have unequal activity levels.

Clustering for Security Operations

Clustering can support several security tasks:

• grouping users with similar access and authentication behavior;
• identifying devices that communicate with similar destinations;
• discovering applications or processes that form unusual communities;
• separating service accounts from human accounts;
• identifying a user who has moved into a cluster associated with a different role;
• organizing alerts so analysts investigate representative patterns rather than thousands of individual events.

A cluster is not inherently safe or dangerous. Its interpretation depends on the features, population, time period, and external evidence. A small cluster of unusual data-transfer behavior may represent either exfiltration or a legitimate analytics team. Clustering is therefore a discovery and prioritization mechanism, not a final verdict.

Dimensionality Reduction and the Problem of High-Dimensional Behavior

Security telemetry often contains hundreds or thousands of features. High dimensionality creates several difficulties. Distances become less informative as dimensions increase, sparse data become harder to model, and visual inspection is impossible. Dimensionality reduction maps observations into a smaller representation while attempting to preserve relevant structure.

Principal Component Analysis (PCA) creates orthogonal linear components that capture decreasing amounts of variance. It is useful for summarizing correlated variables, reducing noise, and preparing numerical data for downstream models. The first principal component does not necessarily represent a security risk; it simply explains a direction of variation in the data. Analysts must inspect feature loadings to understand what the components mean.

t-distributed Stochastic Neighbor Embedding (t-SNE) and Uniform Manifold Approximation and Projection (UMAP) are nonlinear techniques frequently used for visualization. They can reveal local neighborhoods and apparent behavioral groups that are difficult to see in the original feature space. However, visual distances, cluster sizes, and apparent gaps may depend strongly on parameters. These methods should not be used casually as proof that a cluster is real or that an observation is anomalous.

Autoencoders provide a different approach. A neural network is trained to reconstruct normal or predominantly normal input. The reconstruction error can serve as an anomaly signal when an observation differs from patterns encoded by the model. Autoencoders can model nonlinear relationships, but they require careful regularization and validation. If anomalous records are common in training data, the model may learn to reconstruct malicious behavior and fail to detect it.

A useful principle is to distinguish visualization from detection. PCA, t-SNE, and UMAP may help an analyst understand a dataset, whereas an operational detector needs stable features, calibrated thresholds, monitoring, and a response process.

Estimating Normality: Density and Probability

Anomaly detection can be framed as estimating how likely an observation is under a model of normal behavior. If a user-day has very low probability under the expected behavioral distribution, it may warrant investigation. Gaussian mixture models represent data as a weighted combination of Gaussian distributions. They can describe several normal subpopulations, such as different job roles or operating shifts, and provide likelihood-based scores.

Kernel density estimation constructs a smooth estimate of the distribution from observed data. It is flexible but can become difficult to use in high dimensions. The bandwidth parameter controls smoothness: a small bandwidth may treat ordinary variation as anomalous, while a large bandwidth may conceal meaningful deviations.

Statistical models are attractive because their scores can be related to probability or distance from a distribution. Yet cybersecurity data often violate assumptions of independence, stationarity, and simple Gaussian structure. Authentication activity has strong time-of-day and day-of-week effects. Network data may be heavy-tailed. A practical system may therefore use robust statistics, separate models for different populations, or ensembles of complementary methods.

Detecting the Unusual

Distance-Based Detection

A simple approach calculates the distance between an observation and a reference point, such as a user’s historical centroid or a peer-group centroid. Large distance indicates behavioral change. Mahalanobis distance improves on Euclidean distance by considering feature covariance, although it is sensitive to unstable covariance estimates and non-Gaussian data.

Distance-based methods are easy to explain: a user-day is unusual because it differs from the user’s or peer group’s normal pattern in specified dimensions. They are less effective when normal behavior has complex, nonlinear, or multimodal structure.

Isolation Forest

Isolation Forest detects observations that are easier to isolate through random partitions of the feature space. An unusual point tends to be separated from other observations in fewer random splits. The method is efficient for large datasets and does not require a distance metric in the same way as centroid methods. It is frequently useful as one component of an anomaly ensemble.

Its output is relative. A high score means that an observation is easier to isolate within the chosen dataset and feature representation; it does not establish malicious intent. Changing the reference population or contamination parameter can change the ranking.

Local Outlier Factor

Local Outlier Factor (LOF) compares the density around an observation with the density around its neighbors. A point may be normal globally but unusual within its local neighborhood, or globally rare but normal for a specialized role. LOF is therefore valuable when behavioral groups have different densities. It can become unstable when neighborhoods are too small, features are poorly scaled, or the data are highly dynamic.

One-Class Support Vector Machines

A one-class Support Vector Machine learns a boundary around a target population, usually normal behavior. It can model nonlinear boundaries through kernels but may require substantial parameter tuning and can be computationally demanding. It is most appropriate when a reasonably clean reference set is available.

Change-Point and Sequence Detection

Many attacks are not isolated events but changes in a sequence. A compromised account may gradually shift from ordinary logins to privilege escalation, discovery commands, archive creation, and external transfer. Change-point methods identify a statistical change in a time series. Markov models, sequence embeddings, and recurrent or transformer-based models can represent transitions between actions.

Sequence analysis is especially important for zero-day activity because individual actions may be legitimate while their order and timing are suspicious. However, sequence models require careful sessionization and are vulnerable to missing logs, irregular time intervals, and adversarial attempts to insert benign actions between malicious steps.

A Practical UEBA Workflow

A robust behavioral analytics program can be organized as a continuous lifecycle rather than a one-time modelling exercise.

First, define the security question. “Detect anomalies” is too broad. A more useful objective might be identifying compromised privileged accounts, unusual access to sensitive repositories, or devices that begin communicating with unfamiliar infrastructure.

Second, establish data governance and collection boundaries. Relevant sources may include identity providers, endpoint telemetry, VPN and network logs, cloud audit records, data-loss-prevention systems, and application audit trails. Timestamps must be normalized, identities correlated, and duplicate events controlled. Missingness and logging changes should be documented.

Third, construct entity and peer-group features. Baselines should be calculated for both individual history and comparable peers. A user’s activity may be compared with the user’s previous four weeks, the user’s department, or other users with the same role. The choice affects the meaning of anomaly scores.

Fourth, preprocess and validate the data. This includes scaling numerical variables, encoding categorical variables, handling missing values, removing leakage, and checking whether attack records have contaminated the supposedly normal training set. Features that directly encode an incident label or analyst decision must not be used in a way that makes evaluation unrealistic.

Fifth, apply one or more models. A practical architecture may combine peer-group clustering, an isolation model for rare combinations, a sequence detector for action order, and a rules engine for high-confidence conditions. Ensembles often improve coverage, but they also complicate explanation and calibration.

Sixth, calibrate scores and thresholds. Thresholds should reflect investigation capacity, asset criticality, and acceptable false-positive rates. A global threshold is often inferior to risk-sensitive thresholds: unusual activity on a domain administrator account may receive more attention than an equally unusual event on a low-impact test account.

Seventh, enrich and investigate. Alerts should include the features driving the score, peer comparisons, historical context, asset sensitivity, authentication assurance, and corroborating signals. Analysts should be able to see why an observation was unusual rather than receiving an opaque numerical ranking.

Finally, learn from outcomes. Confirmed incidents, benign explanations, analyst dismissals, and environmental changes should inform retraining and feature review. Feedback must be governed carefully; blindly treating every analyst dismissal as a permanent negative label can teach the system to ignore emerging threats.

Applied Scenario: A Compromised Privileged Account

The following is an illustrative case designed to demonstrate the analytical workflow.

Background

A financial services organization operates a hybrid environment with on-premises identity services, cloud collaboration platforms, and sensitive transaction databases. Its security team has deployed UEBA for privileged and high-value accounts. The organization has several hundred administrators, database engineers, and automated service identities.

Situation and Problem

An administrator’s credentials are obtained through a phishing attack. The attacker connects through a recognized VPN service, passes multifactor authentication using a stolen session token, and accesses systems within the administrator’s technical permissions. No known malicious IP address or malware signature is present.

During one day, the account shows several deviations: it authenticates from a new device, accesses a database cluster outside its normal support group, performs administrative queries at an unusual time, and transfers a compressed archive to a cloud storage location not previously used by the account.

Analysis

A peer-group clustering model places the user historically within a small cluster of database administrators. The new user-day remains close to that cluster for ordinary maintenance features but is an outlier on destination novelty, time-of-access, and transfer volume. An isolation model assigns a high anomaly score because the combination is rare. A sequence model identifies an unusual progression: new-device authentication, privilege-related queries, archive creation, and external transfer.

No single feature proves compromise. New-device access may be legitimate, and cloud transfer may be part of an approved project. The combined evidence, however, produces a substantially higher risk assessment than any individual event. The asset sensitivity and privileged role further increase priority.

Strategy and Response

The security operations team validates whether the administrator was working at the stated time, checks the session-token history, reviews endpoint telemetry, and compares the destination with approved cloud services. In parallel, the identity team revokes active sessions and requires fresh authentication. Access to the affected databases is temporarily restricted while the incident response team preserves evidence.

The organization does not automatically terminate every high-scoring session. Instead, it uses the anomaly score to trigger risk-based containment and human verification. The investigation confirms that the administrator was not responsible for the activity and that the token had been misused.

Outcome

The account is reset, active tokens are revoked, and the external transfer is blocked. The organization adds a feature representing session-token continuity, improves detection of new-device and new-destination combinations, and updates its privileged-access policy. The case is recorded as a confirmed compromise and used for controlled evaluation of the model.

Learning Points

The case illustrates five principles. Behavioral anomalies are relational rather than absolute. Multiple weak signals can become compelling when combined. Peer groups are necessary because different roles have different normal behavior. Context, especially privilege and asset criticality, affects response priority. Finally, automated analytics should support proportionate containment and investigation rather than make unsupported accusations.

Challenges, Failure Modes, and Limitations

The principal operational challenge is the false-positive problem. Legitimate changes in work patterns can resemble attacks. Excessive alerts produce analyst fatigue, encourage indiscriminate threshold increases, and may cause genuine incidents to be overlooked. Conversely, a model optimized only for low alert volume may miss subtle compromises.

Concept drift is another concern. Organizations change applications, work locations, network architecture, and business processes. A baseline trained before a cloud migration may treat normal post-migration activity as anomalous. Models require drift monitoring, retraining policies, and change-management integration.

Data quality can be more damaging than algorithm choice. Clock differences, missing endpoint records, identity aliases, NAT, shared accounts, and inconsistent logging can create artificial anomalies. Shared administrative accounts are especially problematic because their behavior combines multiple individuals. Strong identity attribution and privileged-access management improve analytical reliability.

Attackers may also adapt. They can imitate normal working hours, use approved tools, remain below volume thresholds, or gradually alter behavior. This is why behavioral analytics should be combined with access controls, endpoint detection, network monitoring, threat intelligence, and investigation procedures.

Evaluation is difficult because the true number of attacks is unknown and labelled incidents are incomplete. Accuracy is a poor standalone measure in highly imbalanced security data. More informative measures include precision at the investigation budget, recall for confirmed incidents, alert delay, analyst effort, and performance across roles and environments. Offline evaluation should be supplemented with controlled simulations and retrospective replay.

Ethical, Privacy, and Governance Considerations

Behavioral analytics can affect employees, contractors, and customers. Monitoring must have a legitimate purpose, a defined scope, and an appropriate legal basis. Organizations should collect only data necessary for stated security objectives and should establish retention, access, auditing, and deletion controls.

An anomaly score should not be treated as a statement that a person is dishonest. It is a model-generated indication that observed activity differs from a reference pattern. Human review, documented procedures, appeal mechanisms, and separation between security investigation and disciplinary action are important safeguards.

Models may reproduce organizational bias. If some groups work unusual shifts or use specialized systems, a poorly designed baseline may flag them disproportionately. Performance should be assessed across relevant populations, and sensitive attributes should not be used casually as proxies for suspicion. Governance should define who can view behavioral data, who may authorize automated containment, how model changes are approved, and how decisions are audited.

Contemporary Developments and Best Practices

Modern security platforms increasingly combine identity graphs, cloud telemetry, endpoint data, graph analytics, and machine learning. Graph-based methods represent relationships among users, devices, applications, resources, and destinations. A newly observed path through this graph can be more informative than an isolated event. Representation learning and self-supervised methods are also being explored to learn from large volumes of unlabelled sequences.

Large language models can assist analysts by summarizing evidence, explaining feature contributions in accessible language, and helping formulate investigative queries. They should not be assumed to provide reliable anomaly scores without validation, and sensitive telemetry must be protected when using external services.

Effective practice rests on several principles:

• define the decision the model is intended to support;
• build peer-aware and time-aware baselines;
• use multiple complementary signals rather than one universal detector;
• preserve explainability at the point of investigation;
• calibrate thresholds to risk and analyst capacity;
• monitor drift, data quality, and population changes;
• evaluate models using operationally meaningful measures;
• integrate analytics with identity, endpoint, network, and response controls;
• maintain privacy, access control, auditability, and human oversight.

Chapter Summary

Unsupervised learning enables cybersecurity teams to discover behavioral structure without relying entirely on known attack labels. Clustering groups similar users, devices, sessions, and activities; dimensionality reduction helps summarize and visualize complex telemetry; density estimation models normal populations; and anomaly detectors identify observations that are rare, isolated, distant, or locally inconsistent. Sequence and change-point methods extend analysis from unusual events to unusual behavioral transitions.

UEBA is most effective when it combines individual history, peer-group comparison, temporal context, asset criticality, and corroborating security signals. Anomaly scores are investigative evidence rather than proof of malicious intent. Successful deployment requires careful feature engineering, threshold calibration, drift management, evaluation, governance, privacy protection, and human-centred response. In this way, unsupervised learning becomes a practical capability for detecting compromised accounts, insider threats, zero-day activity, and previously unseen attack patterns.

Key Terms

Unsupervised learning: Machine learning that identifies structure in data without target labels.

Behavioral analytics: Analysis of activity patterns to identify normality, change, and unusual behavior.

UEBA: User and Entity Behavior Analytics used to monitor behavior of people, devices, applications, and other entities.

Feature: A measurable attribute used to represent an observation for analysis.

Peer group: A set of entities with comparable roles, functions, or operating conditions.

Clustering: Grouping observations according to similarity.

Centroid: The representative mean position of observations in a cluster.

DBSCAN: A density-based clustering algorithm that can identify irregular clusters and noise.

Dimensionality reduction: Transformation of data into fewer variables while preserving useful structure.

PCA: A linear dimensionality-reduction method based on directions of maximum variance.

t-SNE: A nonlinear method mainly used to visualize local relationships in high-dimensional data.

Density estimation: Modelling the distribution or concentration of observations.

Anomaly: An observation that differs substantially from an established behavioral pattern.

Isolation Forest: An anomaly detector that identifies observations easily separated by random partitions.

Local Outlier Factor: A method that compares the local density of an observation with that of its neighbors.

Concept drift: Change in the underlying data or behavior distribution over time.

Sequence analysis: Examination of ordered actions and transitions rather than isolated events.

Score calibration: Relating model scores to operational risk, priority, or expected outcomes.

Model contamination: Inclusion of anomalous or malicious data in a dataset intended to represent normal behavior.

Explainability: The ability to communicate why a model produced a particular result.

Review Questions

Short Answer Questions

1. Why are peer groups important in behavioral analytics?

2. What is the main purpose of dimensionality reduction in cybersecurity data analysis?

3. How does Isolation Forest identify potentially anomalous observations?

4. Distinguish between an anomaly score and a confirmed security incident.

5. What is concept drift, and why does it affect UEBA systems?

Long Answer Questions

1. Explain how clustering can be used to model users, devices, and service accounts, including the limitations of k-means.

2. Compare distance-based, density-based, and isolation-based anomaly detection methods.

3. Describe a complete UEBA workflow from problem definition through model feedback and retraining.

4. Discuss how temporal context and sequence analysis improve detection of compromised accounts.

5. Examine the privacy, ethical, and governance issues involved in employee behavioral analytics.

Analytical / Application Questions

1. A developer accesses a sensitive repository from a new device during a weekend release, transfers a large archive to an approved cloud service, and has no known malicious indicators. Design an investigation using peer comparison, anomaly scoring, and contextual evidence. Explain what additional information is required before containment.

2. An organization’s anomaly detector produces many alerts after a major migration to cloud infrastructure. Analyse the likely causes and propose a technically and operationally sound remediation plan.

3. Design an ensemble for detecting previously unseen activity by privileged accounts. Specify suitable features, at least three analytical methods, threshold considerations, evaluation measures, and human-response controls.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes the role of unsupervised learning in cybersecurity?

A. It proves that every unusual event is malicious.

B. It discovers structure and deviations without requiring complete attack labels.

C. It replaces all signature and rule-based controls.

D. It can operate accurately without suitable feature engineering.

Correct Answer: B. It discovers structure and deviations without requiring complete attack labels.

Question 2

Why should behavioral features usually be scaled before applying k-means?

A. Scaling guarantees that the chosen number of clusters is correct.

B. Scaling removes all anomalous observations.

C. Without scaling, variables with larger numerical units may dominate similarity calculations.

D. Without scaling, categorical variables automatically become labels.

Correct Answer: C. Without scaling, variables with larger numerical units may dominate similarity calculations.

Question 3

Which method is particularly suited to identifying clusters of irregular shape while marking sparse observations as noise?

A. DBSCAN

B. PCA

C. K-means with one cluster

D. Naive Bayes

Correct Answer: A. DBSCAN

Question 4

What is a major distinction between visualization and operational anomaly detection when using t-SNE or UMAP?

A. Visualization methods always produce calibrated probabilities.

B. A visual separation is not by itself proof that a cluster or anomaly is operationally real.

C. Operational detectors do not require validation or thresholds.

D. t-SNE can only process labelled attack data.

Correct Answer: B. A visual separation is not by itself proof that a cluster or anomaly is operationally real.

Question 5

A user is normal globally but has unusually low activity density compared with users in the same specialized role. Which method is most directly designed to examine this local difference?

A. Local Outlier Factor

B. Principal Component Analysis

C. K-means with random labels

D. A signature database

Correct Answer: A. Local Outlier Factor

Question 6

Why can a high anomaly score not be treated as proof of insider threat?

A. Anomaly models never use behavioral data.

B. High scores may reflect legitimate changes, data errors, or unusual but authorized work.

C. Anomaly scores are always identical for all users.

D. Insider threats are detectable only by malware signatures.

Correct Answer: B. High scores may reflect legitimate changes, data errors, or unusual but authorized work.

Question 7

Which sequence provides the strongest example of why sequence analysis can add value?

A. One successful login during normal working hours.

B. A stable weekly pattern of approved application use.

C. New-device login followed by privilege queries, archive creation, and external transfer.

D. A routine password-expiration notification.

Correct Answer: C. New-device login followed by privilege queries, archive creation, and external transfer.

Question 8

What is concept drift in a UEBA environment?

A. The permanent removal of all model features.

B. A change in the underlying behavior or data distribution over time.

C. A method for encrypting audit logs.

D. The conversion of labels into numerical values.

Correct Answer: B. A change in the underlying behavior or data distribution over time.

Question 9

Which evaluation approach is most appropriate for a security anomaly detector with limited analyst capacity?

A. Use accuracy alone because attacks are common.

B. Measure only the number of generated alerts.

C. Consider measures such as precision at investigation budget, incident recall, alert delay, and analyst effort.

D. Evaluate only on synthetic data and ignore confirmed incidents.

Correct Answer: C. Consider measures such as precision at investigation budget, incident recall, alert delay, and analyst effort.

Question 10

What is the most appropriate response to an unusually high score on a privileged account?

A. Immediately accuse the account owner of malicious behavior.

B. Ignore the score because unsupervised models cannot be useful.

C. Combine the score with context and corroborating evidence, then apply proportionate investigation or containment.

D. Automatically delete all records associated with the account.

Correct Answer: C. Combine the score with context and corroborating evidence, then apply proportionate investigation or containment.