The engineer has a labeled dataset of network sessions. The features were assembled by a junior data...

Question

The engineer has a labeled dataset of network sessions. The features were assembled by a junior data scientist who joined both the raw session metadata and a SIEM log that already contains analyst-verified malicious/benign labels. The model achieves 99.98% accuracy in testing. An ML engineer building a network intrusion detection model notices that one feature is 'total bytes transferred in session' and another is 'was this session flagged as malicious in the SIEM.' The second feature is included by mistake. What is this problem called, and what will happen in production?

Accepted Answer

Feature leakage (data leakage): the second feature contains the answer (ground truth label) in disguised form - in production, this SIEM flag will not exist for new sessions being classified in real-time, causing the model to fail catastrophically on real prediction tasks

Answer

Multicollinearity: having two correlated features degrades model performance and should be resolved by removing one, because feature scaling rescales the label column along with the inputs

Answer

Overfitting: the model is memorizing the SIEM labels from training data

Answer

Class imbalance: the SIEM flag causes the model to over-classify sessions as malicious

An ML engineer building a network intrusion detection model notices that one feature is 'total bytes transferred in session' and another is 'was this session flagged as malicious in the SIEM.' The second feature is included by mistake. What is this problem called, and what will happen in production?

Where this fits in the AI Security Fundamentals exam

One question down. Thousands to go.

Where this fits in the AI Security Fundamentals exam

More free AI & ML Concepts for Security questions

One question down. Thousands to go.