ARTIFICIAL INTELLIGENCE AND MACHINE LEARNING FOR CYBERSECURITY

About this textbook

What does it take to build an AI detector that is useful in a real security operation—and how do we protect the AI system itself from attackers?

Artificial Intelligence and Machine Learning for Cybersecurity is a structured, English-language graduate textbook connecting classical cybersecurity engineering with modern machine learning. It begins at the foundations and progresses through practical data pipelines, defensive models, adversarial machine learning, privacy engineering, secure LLMs and autonomous cyber defense. Its 70-chapter architecture makes it useful for master's-level coursework, supervised projects and independent technical study.

The book explains why a model's headline accuracy is not enough. Real defenses operate with rare attacks, noisy logs, finite analyst attention, evolving adversaries and decisions that can interrupt essential services. Examples and Python-based discussions encourage readers to examine what a system observes, what its model predicts, what evidence supports a conclusion and which response is actually authorized.

A complete learning path in ten parts

Each part expands the toolkit needed to reason about intelligent cybersecurity systems, from first principles to advanced research questions.

1. I
   Cybersecurity and security engineering foundationsSecurity goals, networks, operating systems, identity, cryptography, incident response.
2. II
   Python, mathematics and machine learningReproducible Python, probability, classifiers, deep learning, graph models and reinforcement learning.
3. III
   Security data and rigorous evaluationSecurity telemetry, feature engineering, rare events, time splits, metrics, calibration and dataset documentation.
4. IV
   Applied intelligent cyber defenseIntrusion, malware, ransomware, phishing, DNS, UEBA, DDoS, cloud security, forensics and threat intelligence.
5. V
   Advanced security intelligenceAttack graphs, self-supervised learning, concept drift, OT, autonomous vehicles and causal reasoning.
6. VI
   Adversarial ML and AI system securityEvasion, poisoning, extraction, robustness, AI-assisted attacks and model supply chains.
7. VII
   Privacy-preserving security MLMembership inference, differential privacy, federated learning and accountable telemetry.
8. VIII
   Generative AI and agent securityLLMs, RAG, prompt injection, red teaming, tool permissions, MCP and SOC copilots.
9. IX
   Production, governance and human factorsMLOps, monitoring, incident recovery, standards, risk economics and edge AI.
10. X
    Research, capstone and emerging directionsResearch design, reproducible security pipelines and post-quantum migration.

What readers will learn

• Start with core cybersecurity principles and build the Python, statistics, machine-learning and deep-learning knowledge needed for graduate coursework.
• Understand which network, endpoint, DNS, cloud and identity events a security sensor can actually observe, and where logs have blind spots.
• Prepare data for security ML without letting future information, duplicated entities or incorrect temporal splits leak into evaluation.
• Compare intrusion, phishing and malware detection models using realistic metrics, base rates, false positives and analyst workload.
• Explain how adversarial evasion, data poisoning, model extraction and AI supply-chain attacks change the defender's threat model.
• Distinguish privacy claims from documented guarantees in differential privacy, federated learning and cryptographic approaches.
• Evaluate prompt injection, retrieval trust boundaries, LLM data leakage, agent tool permissions and guarded automated response.
• Plan responsible model deployment, drift monitoring, incident recovery, reproducibility and a defensible end-to-end security capstone.

Visual explanations and Python-based learning

The textbook uses scientific diagrams, workflows, illustrative case studies and Python examples to connect mathematical ideas with security-engineering decisions. Visual topics include the journey from logs to features and risk scores, how data leakage can create misleading experimental results, the cost of excessive false alerts, the distinction between model confidence and a permission to act, and the safeguards needed around LLM tools and agentic workflows.

For visually oriented beginners, companion infographic concepts also turn concepts such as analyst alert fatigue, security trade-offs, edge AI resource budgets, tail latency, reproducible experiments and post-quantum migration into memorable real-world analogies. These are educational illustrations, not claims of operational measurement.

Representative questions the book helps answer

• Why can a classifier with seemingly high accuracy generate more false alarms than an analyst team can review?
• How does an AI system distinguish an unusual process or DNS request from a genuinely malicious incident?
• Why do chronological train/test splits matter for continuously evolving security data?
• How can adversarial examples, poisoning and model extraction undermine an otherwise useful detector?
• What changes when an LLM retrieves untrusted documents or an AI agent can call tools and take actions?
• Which evidence, permissions, rollback paths and monitoring controls are needed before automation reaches production?
• How should a graduate capstone document its data, code, experiment settings, failures and limitations?

Key subjects covered

• Artificial intelligence in cybersecurity
• Machine learning for threat detection
• Network intrusion detection
• Malware and ransomware analysis
• Phishing and DNS security
• Endpoint, cloud and container telemetry
• Security data engineering
• Data leakage and time-based validation
• Precision, recall, calibration and concept drift
• Graph neural networks and attack graphs
• Adversarial machine learning and data poisoning
• Model extraction and model supply-chain security
• Differential privacy and federated learning
• Large language model (LLM) security
• RAG and prompt injection
• Agentic AI and MCP security
• Secure MLOps and model governance
• Autonomous cyber defense
• Post-quantum cybersecurity
• Graduate research and reproducible Python labs

Who this book is for

Master's students in artificial intelligence, machine learning, computer science and cybersecurity; lecturers designing graduate coursework; security engineers and analysts evaluating AI-assisted detection; and researchers developing reproducible experiments, secure intelligent applications or applied thesis projects. Readers can begin with the foundational material and advance toward more specialized chapters as their knowledge develops.

Scientific and practical perspective

The book separates conceptual diagrams and synthetic teaching examples from real-world evidence. Its emphasis is on reproducibility, correct use of metrics, transparent limitations and risk-aware defensive decisions. Official standards, technical documentation and research references support the framework. A working example is not automatically a validated field deployment, and a promising model is not automatically safe to grant operational authority.