Decision tree

A decision tree learns by repeatedly splitting a dataset on whichever feature best separates the outcomes. “Is the file signed?” No. “Was it downloaded in the last hour?” Yes. “Does it write to the registry on launch?” Yes. Each answer moves down a branch until the path ends in a decision: malicious, or benign. Training is the process of working out which questions to ask, and in what order. Applying the model afterwards is just walking the path. It is a supervised learning method, since the training examples have to arrive already labelled.

That structure is why decision trees keep their place in security tooling despite being one of the older ideas in machine learning. The path the tree takes is the explanation. You can print it, read it, hand it to an auditor, and argue with it. When a neural network flags an account you get a score. When a decision tree flags an account you get the sequence of conditions that produced the flag, which is the difference between a finding you can act on and one you can only trust.

Their weakness is the same as their strength. A single tree grown deep enough will fit its training data exactly, memorising noise as though it were signal, then fail on anything it has not seen. This is why production systems rarely use one tree: they combine hundreds (a random forest, or a gradient-boosted ensemble) and trade away the readability that made a single tree attractive in the first place. Worth remembering when a vendor calls their detection “explainable”. Ask whether that means one tree, or five hundred averaged together.