Before training a model, my malware classifier could already score 100%. How a leaked filename and duplicate PE headers nearly invalidated the results.
Tag: machine learning
97% Accurate and Still Missing Spam
Two spam filters scored over 97% accuracy. One missed 21% of spam. Why accuracy fails on imbalanced data, and what recall and F1 reveal instead.
Linear Algebra Behind for Cybersecurity ML Models
Naive Bayes assumes every feature is independent. For spam detection, that’s provably false — words in a sentence are obviously correlated. The model works well anyway. Figuring out why a wrong assumption still produces a right answer taught me more than a correct model would have. It’s also the thing that shifted how I read…
How ML Detects DDoS Attacks: Benefits and Limits
A rule-based system catches the DDoS attack you’ve already seen. An attacker who stays under your volumetric threshold walks past it. Machine learning changes the question from “is traffic above X requests per second” to “does this traffic look structurally normal” — timing, source entropy, protocol distribution. Low-volume attacks with improbable source diversity still register…