CyberCertPrepAI Security FundamentalsAI & ML Concepts for SecurityEASYFree question
A threat intelligence team wants to automatically classify newly discovered malware into known families. They have 50,000 labeled malware samples. Which ML approach is most appropriate?
- A.A. Supervised classification - use the labeled samples to train a multiclass classifier that maps malware features to family labels
- B.B. Unsupervised clustering - because labeled data always introduces bias in security contexts
- C.C. Reinforcement learning - the model learns from analyst feedback rewards over time
- D.D. Self-supervised pretraining - pretrain on unlabeled binaries then use as-is without fine-tuning
Why A is correct
With 50,000 labeled samples and a clear classification objective (map sample → known family), supervised learning is the direct and most effective approach. Labeled data is a strength, not a problem (B). RL (C) is theoretically applicable but requires defining a reward structure and is impractical for this clearly supervised task where labels are available. Self-supervised pretraining (D) is valuable when labels are scarce; with 50K labels you would fine-tune a supervised head rather than using unsupervised pre-trained representations as-is.
Know someone studying for AI Security Fundamentals? Send them this one.