Machine Learning Algorithms

Ask where the feedback comes from

The useful question is: what tells the system how to improve? Different learning approaches use different answers. They are categories of methods, not four individual algorithms.

Supervised: examples with answers

The model receives inputs with labels. It learns a relationship between them so it can predict an answer for another input.

An everyday example is learning fruit names from pictures already marked “apple” and “pear.” A security example is learning from files that reviewers have labelled harmful or harmless.

Classification predicts a category. Regression predicts a numerical value, such as tomorrow’s number of help desk requests. Neither is automatically correct just because it uses learning. Wrong labels can teach the wrong lesson.

For the underlying distinction, read Google’s introduction to ML.

Unsupervised: find structure without answer labels

The model explores patterns in data without being given the target category for each example. Clustering means grouping similar examples.

Imagine organising a mixed box of buttons by their appearance before anyone gives the groups names. In security, a system might group computers with similar network behaviour. A small unusual group is a reason to investigate, not proof of an attack. Backup servers and software updates can also behave differently from ordinary laptops.

People still need to interpret the patterns. The scikit-learn clustering guide compares ways to form these groups.

Semi-supervised: a few answers plus many other examples

Here the learning process uses both labelled and unlabelled examples. For instance, a team may have 300 carefully reviewed messages and 30,000 messages without labels. A suitable method can use information from both groups.

This is useful when expert review takes time. It also needs care. One method predicts labels for some unlabelled examples and learns from those predictions. If the first predictions are wrong, the mistakes can spread.

The scikit-learn semi-supervised guide describes this approach and its assumptions. More unlabelled data does not guarantee improvement.

Reinforcement: actions and rewards

An agent takes actions in an environment, which is the world or simulation it can interact with. A reward gives feedback about the result. A policy is its learned way of selecting actions.

Picture a delivery robot learning routes in a simulation. It receives rewards for successful deliveries and penalties for collisions. A security training simulation could instead reward useful investigation steps and penalise unnecessary disruption.

Rewarding only speed might encourage a system to skip checks. A high score does not prove the real goal was met. PyTorch’s reinforcement-learning tutorial provides an optional coding example.

Extra: self-supervised learning

Self-supervised learning creates a learning target from the data itself. For example, text can provide both the beginning of a passage and the next token the model should predict. A person does not need to label every prediction target by hand.

This differs from semi-supervised learning. Semi-supervised methods combine labelled and unlabelled examples. Self-supervised methods construct their training signal from the examples. Google’s LLM training explanation adds context.

Check your understanding

A system groups similar login patterns. A person later names each group. Which learning style best describes the grouping step?

Unsupervised learning. The grouping did not begin with answer labels for each login. A later human interpretation does not turn that earlier step into supervised learning.

Why is “unusual” not the same as “malicious”?

Unusual means different from the comparison data. A new employee, a night shift, or a legitimate maintenance job may be unusual without being an attack.