Week 6: Unsupervised Learning: Finding Hidden Patterns

Dates: Feb 16-20  ·  Reading: Handout 5: Unsupervised Learning and Clustering

Two hands-on lectures that take Week 5’s intuition into practice. Monday: clustering done well - choosing k with the elbow method, why feature scaling matters, and hierarchical clustering with dendrograms. Wednesday: anomaly detection - Isolation Forests and Local Outlier Factor - to flag unusual logins and traffic. Lab 5 released this week.

📄 Read Handout 5 (PDF)

Learning Objectives

• Explain unsupervised learning as finding patterns in data without labels
• Describe clustering and what a “cluster” means in security data
• Identify business and security uses of clustering (and anomaly detection)
• Interpret simple cluster visualizations

Lecture Slides

⬇ Monday: Clustering in Depth (PPTX) ⬇ Wednesday: Anomaly Detection (PPTX)

Two full 75-minute decks, CSU-branded, with elbow/scaling/dendrogram/Isolation-Forest figures, Colab code, activities, and detailed speaker notes on every slide.

Monday Session

Clustering in depth: the two decisions that make or break it - how many groups (the elbow method) and which features on what scale (feature scaling). Doing k-means well in Colab, then hierarchical clustering and how to read a dendrogram, and finally evaluating and interpreting clusters on real network-traffic data.

Wednesday Session

Anomaly detection: what an anomaly is and why it matters in security, how an Isolation Forest flags outliers (no math), Local Outlier Factor as a second opinion, choosing a contamination/alert level, and a real case - detecting unusual login patterns end to end.

Lab

Lab 5: Clustering and Anomaly Detection. Scale features, choose k with the elbow method, cluster network traffic with k-means and interpret the groups, then flag anomalies with an Isolation Forest and inspect the suspicious sessions.

⬇ Lab 5 starter notebook (.ipynb)

Download, then open in Google Colab (File → Upload notebook). Submit your completed notebook in Canvas.

Quiz / This Week

Quiz 5. Unsupervised learning; clustering; k-means & hierarchical; scaling & the elbow method; anomaly detection; cluster interpretation.

In-Class Activity

Intrusion Detection and Anomaly Analysis — Hacker101-style guided security lesson. Graded, 20 points.

⬇ Activity slides (PPTX) 📄 Student worksheet (PDF)

Graded in-class activity with a worksheet. Full rotation on the Activities page.

---

← All lecture notes  ·  Assessments unlock on the Quizzes and Labs pages when the instructor releases them.