An unsupervised self-learning system is used to define what the normal network looks like, and then uses this to backtrack and report any deviations or anomalies in real-time. Which approach is this?

An unsupervised self-learning system is used to define what the normal network looks like, and then uses this to backtrack and report any deviations or anomalies in real-time. Which approach is this?

• A. Machine Learning
• B. Classification
• C. Unsupervised Learning
• D. Regression

Answer: (C)

Anomaly detection using unsupervised learning. In this approach, the system learns from unlabeled data to establish what normal network behavior looks like, building a baseline without needing examples of anomalies. Once this model of normality is in place, real-time monitoring compares current activity to the baseline and flags deviations as potential anomalies. This fits scenarios where anomalies are rare and labeled examples are not available for training. Techniques in this realm include clustering to identify typical patterns, density estimation to model normal data distribution, one-class classification to separate normal from everything else, or autoencoders that reconstruct normal traffic well but struggle with unusual data. In contrast, supervised machine learning would require labeled examples of both normal and anomalous traffic to train a model, and regression or standard classification models aren’t inherently geared toward discovering new, unseen anomalies from unlabeled data.

Anomaly detection using unsupervised learning. In this approach, the system learns from unlabeled data to establish what normal network behavior looks like, building a baseline without needing examples of anomalies. Once this model of normality is in place, real-time monitoring compares current activity to the baseline and flags deviations as potential anomalies. This fits scenarios where anomalies are rare and labeled examples are not available for training. Techniques in this realm include clustering to identify typical patterns, density estimation to model normal data distribution, one-class classification to separate normal from everything else, or autoencoders that reconstruct normal traffic well but struggle with unusual data. In contrast, supervised machine learning would require labeled examples of both normal and anomalous traffic to train a model, and regression or standard classification models aren’t inherently geared toward discovering new, unseen anomalies from unlabeled data.