Week 5: Unsupervised Learning and Exam 1

Dates: Feb 9-13 · Reading: Handout 4: Regression and Model Metrics · Exam 1: online this week (90 min, Weeks 1-4)

Monday is a full 75-minute lecture introducing unsupervised learning: why and when you have no labels, clustering as a security tool, k-means vs. hierarchical clustering explained visually, and a live demo clustering login behaviors to spot anomalies. Wednesday is exam week: Exam 1 is an online exam (taken via Canvas during the exam window), and the class period covers exam logistics plus a short preview of Week 6. Lab 4 is due Monday.

Learning Objectives

Explain unsupervised learning as finding patterns in data without labels
Describe clustering and what a “cluster” means in security data
Identify business and security uses of clustering
Interpret a simple cluster visualization

Lecture Slides

⬇ Monday: Unsupervised Learning (PPTX) ⬇ Wednesday: Exam 1 & Week 6 Preview (PPTX)

Monday is a full 75-minute deck (CSU-branded) with supervised-vs-unsupervised, clustering, dendrogram, and k-means-vs-hierarchical figures, a live-demo code walkthrough, activities, and detailed speaker notes on every slide.

Exam 1 Prep (online this week)

📄 Exam 1 Study Guide (PDF) 📝 Practice Exam (PDF) ✅ Practice Exam Answer Key (PDF)

Exam 1 is 90 minutes, 100 points, online via Canvas with LockDown Browser, covering Weeks 1-4. It includes multiple-choice, true/false, short-answer, and applied-scenario questions. Try the practice exam closed-book and timed, then check the answer key (its questions differ from the real exam).

Monday Session

A detailed, intuition-first introduction to unsupervised learning: why and when you don’t have labels; clustering as a security tool for grouping network traffic, user behavior, and malware samples; what a “cluster” means in security data; and the difference between k-means and hierarchical clustering explained visually (including how to read a dendrogram). Closes with a live demo: clustering a month of login behaviors with k-means and flagging anomalies, exactly the workflow used in Lab 5.

Wednesday Session

Exam 1 is taken online (asynchronous) via Canvas with LockDown Browser this week (90 minutes, 100 points, covers Weeks 1-4). The class period confirms exam logistics and gives a short preview of Week 6 unsupervised techniques (deeper k-means, dendrograms, isolation forests) and what students will explore in the Lab 5 hands-on.

This Week

Lab 4 due Monday.
Exam 1: online this week (90 minutes, 100 points; covers Weeks 1-4). Taken via Canvas with LockDown Browser during the exam window.
Prep with the Exam 1 Study Guide, the Practice Exam (with answer key), and Handout 4; install and test LockDown Browser in advance.
Coming in Week 6: unsupervised learning goes hands-on (Lab 5: Clustering & Anomaly Detection).

In-Class Activity

Anomaly Detector False Alarms — CISA-style incident-response tabletop (small groups). Graded, 20 points.

⬇ Activity slides (PPTX) 📄 Student worksheet (PDF)

Graded in-class activity with a worksheet. Full rotation on the Activities page.

← All lecture notes · Exam released through the Exams page when the instructor opens it.