<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-machine-learning-detections
description: >-
  Build, train, evaluate, and deploy machine learning models for anomaly detection, behavioral analysis, and threat classification in security telemetry.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - machine-learning
  - anomaly-detection
  - behavioral-analysis
  - threat-classification
  - feature-engineering
  - model-training
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Building Machine Learning Detections

## Overview

Machine learning detections augment signature-based rules by identifying
anomalous behavior and novel threats. Covers feature engineering from security
logs, model selection, training pipelines, drift detection, and deployment.

## Prerequisites

| Requirement | Purpose |
|---|---|
| scikit-learn | `pip install scikit-learn` |
| pandas | `pip install pandas` |
| Security telemetry | Labeled dataset for supervised learning or baseline for unsupervised |

## Key Concepts

### ML Detection Pipeline

```python
# Anomaly detection pipeline for authentication logs
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler
import pandas as pd

def build_auth_anomaly_detector(log_path: str) -> dict:
    """Build an Isolation Forest model for auth anomaly detection."""
    df = pd.read_json(log_path, lines=True)
    features = df[["login_hour", "failed_count", "geo_distance",
                    "user_agent_entropy", "session_duration"]].copy()
    scaler = StandardScaler()
    X = scaler.fit_transform(features)
    model = IsolationForest(
        contamination=0.01,
        n_estimators=200,
        random_state=42,
    )
    model.fit(X)
    scores = model.decision_function(X)
    return {"model": model, "scaler": scaler,
            "anomaly_threshold": float(scores.mean() - 2 * scores.std())}
```

## Workflow

1. **Define use case** — Specify detection goal and success metrics
2. **Collect telemetry** — Gather labeled or baseline security log data
3. **Engineer features** — Extract meaningful signals from raw telemetry
4. **Select model** — Choose algorithm appropriate for detection type
5. **Train and validate** — Fit model with cross-validation and holdout testing
6. **Evaluate performance** — Measure precision, recall, F1, and false positive rate
7. **Deploy and monitor** — Integrate model into detection pipeline with drift tracking

## Detection

```yaml
title: Machine Learning Detections Detection
id: 98e7a1e0-9ee1-4d13-a504-28c6b2becc7b
status: experimental
description: Detects suspicious activity related to building machine learning detections techniques in detection engineering context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*machine*"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.defense_evasion
falsepositives:
  - Detection rule testing in staging SIEM environment
```

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
