Unsupervised learning

Unsupervised learning is the branch of machine learning given data and no answers. There are no labels saying which login was an intrusion or which transaction was fraud. The algorithm’s job is to find structure already present in the data: which records resemble each other, which sit far away from everything else, which dimensions actually carry information. What it produces is a description of the data’s shape, not a verdict about it.

For security this is frequently the only option available. Labelled attack data is scarce, expensive, and out of date by the time it is assembled, and by definition you hold no labelled examples of the attack nobody has seen yet. Unsupervised methods sidestep that problem by learning what your environment normally looks like and surfacing whatever departs from it. That is the engine underneath most user behaviour analytics, peer group analysis, and the log triage that reduces millions of events to a reviewable handful. Where supervised learning needs someone to have already decided what bad looks like, this does not. K-means clustering is the most common example in practice.

The failure mode follows directly from the method. An unsupervised model can tell you something is unusual. It cannot tell you something is wrong, because it was never shown the difference. A finance director logging in at 3am during quarter close is a genuine outlier and entirely innocent. A new deployment tool is an outlier on its first day and every day after until the baseline absorbs it. Treating the output as a queue of things worth a human look is sound. Treating it as a list of incidents produces alert fatigue and eventually an analyst who stops reading the queue.