An organization is evaluating AI use cases in its SOC. A security architect wants to implement an AI system that identifies previously unseen attack patterns in network traffic without using labeled threat examples. Which AI technique is most suitable?

Question

Accepted Answer

A. Unsupervised learning — anomaly detection using clustering or density-based methods. Unsupervised anomaly detection identifies deviations from normal behavior without requiring labeled attack examples, which is ideal for detecting novel or unknown attack patterns. The SecAI+ objectives include AI applications in security such as threat detection, and unsupervised techniques are the appropriate choice when labeled threat data is unavailable. Supervised learning requires labeled attack examples, which the scenario explicitly excludes. Reinforcement learning trains an agent through interaction, not by identifying anomalies in existing traffic.

An organization is evaluating AI use cases in its SOC. A security architect wants to implement an AI system that identifies previously unseen attack patterns in network traffic without using labeled threat examples. Which AI technique is most suitable?

Related Questions

Discussion