CyberCertPrepAI Security FundamentalsAI & ML Concepts for SecurityEASYFree question
Scenario
The engineer has a labeled dataset of network sessions. The features were assembled by a junior data scientist who joined both the raw session metadata and a SIEM log that already contains analyst-verified malicious/benign labels. The model achieves 99.98% accuracy in testing.
An ML engineer building a network intrusion detection model notices that one feature is 'total bytes transferred in session' and another is 'was this session flagged as malicious in the SIEM.' The second feature is included by mistake. What is this problem called, and what will happen in production?
- A.Feature leakage (data leakage): the second feature contains the answer (ground truth label) in disguised form - in production, this SIEM flag will not exist for new sessions being classified in real-time, causing the model to fail catastrophically on real prediction tasks
- B.Multicollinearity: having two correlated features degrades model performance and should be resolved by removing one
- C.Overfitting: the model is memorizing the SIEM labels from training data
- D.Class imbalance: the SIEM flag causes the model to over-classify sessions as malicious