Define artificial intelligence, list what AI systems can do, and explain the data-volume problem that motivates AI.

• Definition — AI is the ability of computers or machines to perform tasks that normally require human intelligence.
• Capabilities — learn from data, recognize patterns, make predictions, understand language, recognize images, solve problems and make decisions, automate repetitive tasks.
• Motivation — humans generate more data every day than people can examine by hand.
• What AI helps with — analyzing large amounts of data quickly, finding hidden patterns, automating repetition, faster and more accurate decisions, detecting unusual activity, reducing workload.
• Worked example — an analyst cannot review millions of network events by hand; an AI system scans all of them and flags suspicious ones in seconds rather than weeks.

Describe the four connected stages of a simple AI system and walk them through the spam-detection example.

• The four stages — Data → Learning → Model → Prediction.
• Stage 1, Data — thousands of past emails are collected.
• Stage 2, Learning — the system analyzes the words and patterns inside them.
• Stage 3, Model — it learns the typical characteristics of spam.
• Stage 4, Prediction — a brand-new email is classified as Spam or Not Spam.
• Key idea — data is one of the most important ingredients of any modern AI system; better data generally means a better model.

Separate Narrow AI, General AI, and Superintelligence by status and example.

• Narrow AI — in use today — designed for one specific task. Examples: spam detection, facial recognition, chatbots, recommendation systems, malware detection.
• General AI — theoretical — capable of performing many intellectual tasks like a human. Still a research goal, not yet achieved.
• Superintelligence — hypothetical — would exceed human intelligence across many areas. Discussed in long-term AI safety research.
• Bottom line — today, almost all practical AI systems in use are Narrow AI.

List the eight major areas of artificial intelligence and state the narrowing path this course follows.

• The eight areas — Machine Learning, Deep Learning, Computer Vision, Natural Language Processing, Robotics, Expert Systems, Knowledge Representation, Search & Optimization.
• Course focus — Artificial Intelligence → Machine Learning → Cybersecurity Applications.
• Why it matters — the course narrows from the broad field down to the ML techniques that get applied to security problems.

Explain how AI, Machine Learning, and Deep Learning nest inside one another.

• Nested circles — Deep Learning sits inside Machine Learning, which sits inside AI.
• AI is the broadest field — the overall goal is to build systems that behave intelligently.
• ML is a subset of AI — a technique where computers learn patterns directly from data.
• DL is a subset of ML — uses multi-layer neural networks for complex data like images and text.

State the two formulas that separate hand-written rules from learned rules.

• AI vs ML — AI is the broad goal of creating systems capable of intelligent behavior; ML is a technique that lets computers learn patterns from data instead of being explicitly programmed for every situation.
• Traditional programming — Data + Rules → Output.
• Machine learning — Data + Expected Outputs → Learning → Model.
• Then, in ML — New Data + Model → Prediction. The trained model makes predictions on data it has never seen before.

Define ML, list common applications, and walk the phishing-detection worked example.

• Definition — ML lets computers learn patterns from data and use those patterns to make predictions or decisions. Simply: learning patterns from data.
• Instead of hand-written rules — the system studies many examples and works out the rules itself.
• Common examples — predict spam, detect fraudulent transactions, predict house prices, recognize malicious network traffic, recommend movies or products, detect malware.
• Phishing setup — 10,000 emails, some Normal and some Phishing, given to the algorithm as labeled examples.
• Patterns learned — suspicious words in the message, unusual or fake-looking URLs, sender information that looks wrong, odd message structure.
• Outcome — a new email passes through the ML model and comes out classified Phishing or Legitimate.

Define Deep Learning and separate it from general ML across six dimensions.

• DL definition — a specialized type of ML that uses artificial neural networks with multiple layers; powerful for images, text, audio, video, and large-scale datasets with millions of examples.
• Relationship — ML is a subset of AI; DL is a subset of ML.
• Learns from — ML finds patterns with algorithms; DL uses multi-layer neural networks.
• Works best with — ML on structured, tabular data; DL on complex or unstructured data such as images and text.
• Feature engineering — ML often needs manual feature selection; DL can automatically learn complex features.
• Dataset size and compute — ML can work with smaller datasets and is usually less computationally expensive; DL often benefits from very large datasets and requires more computing power.
• In cybersecurity — both can be useful; the right choice depends on the data available and the problem being solved.

Define CV and NLP, list what each works with, and match the technique to the data type.

• Computer Vision — enables computers to understand and analyze visual information. Works with images, videos, camera feeds, scanned documents.
• CV examples — face recognition, object detection, medical image analysis, license-plate recognition, security-camera analysis; also face detection, object recognition, image classification.
• Natural Language Processing — enables computers to understand, analyze, and generate human language. Works with text and documents, emails and messages, speech converted to text.
• NLP examples — chatbots, language translation, sentiment analysis, email classification, phishing-email detection, text summarization.
• Matching rule — Text → NLP; Images / Video → Computer Vision. Both are important areas of modern AI and many real systems combine them.

Separate supervised, unsupervised, and reinforcement learning by data, goal, and cybersecurity use.

• Supervised — learns from labeled data where the correct answer is already known; model learns Input → Known Output, then predicts the label of brand-new unseen data. Cybersecurity: malware classification, spam vs legitimate email, fraud vs legitimate transaction, malicious vs normal traffic.
• Unsupervised — works with data that has no predefined labels; discovers groups of similar data, hidden patterns, similarities and differences, unusual behavior. An anomaly signals a possible security threat.
• Reinforcement — an agent learns by interacting with an environment through the loop Observes → Takes Action → Receives Reward/Penalty → Learns.
• RL security example — the system observes a possible attack and can allow the traffic, block the traffic, or request additional verification; good decisions earn rewards, bad ones earn penalties, and over time it learns better defensive strategies.
• Summary table — Supervised: labeled data, predict known classes, malware classification. Unsupervised: unlabeled data, discover patterns, anomaly detection. Reinforcement: rewards/penalties, learn actions, adaptive cyber defense.
• Memory hook — supervised = learn with answers; unsupervised = find patterns without answers; reinforcement = learn from rewards.

Define data, separate the two types with cybersecurity examples, and state the quality principle.

• Definition — data is information collected and stored so it can be analyzed or used by computer systems. It can represent numbers and text, images/video/audio, network traffic, user activities and computer logs, and transactions.
• Key idea — Data → Learning → Model → Prediction. AI depends heavily on data; poor-quality data leads to poor-quality models — "garbage in, garbage out."
• Structured data — organized in a predefined format, often rows and columns. Examples: database tables, Excel files, transaction records, customer information.
• Unstructured data — data without a simple tabular structure. Examples: images and videos, emails and documents, audio, social media posts.
• Structured security example — a table of IP address, failed logins, data transfer, and threat label; ML uses those features to detect suspicious behavior without a human reviewing every row.
• Unstructured security example — phishing email text, security reports and PDFs, screenshots and images, malware files, chat messages, audio/video evidence.
• Bottom line — AI techniques can work with both types, often in the same system.

Recite the seven pipeline steps in order and apply them to a cybersecurity problem.

• Step 1 — Collect Data.
• Step 2 — Clean & Prepare Data.
• Step 3 — Select Useful Features.
• Step 4 — Train a Model.
• Step 5 — Evaluate the Model.
• Step 6 — Make Predictions.
• Step 7 — Deploy & Monitor.
• Security application — Network Logs → Prepare Data → Train Model → Detect Attacks. The same pipeline that predicts house prices or recommends movies can be pointed at network logs; only the data and the goal change.

Define cybersecurity, list what it protects, and explain the stakes.

• Definition — cybersecurity protects digital systems and information from unauthorized access, damage, disruption, and attack.
• What it protects — computers, servers, and mobile devices; networks and cloud systems; applications; personal information; organizational data.
• Why it matters — modern society depends heavily on digital systems: banking, healthcare, education, government, transportation, communication, business, national infrastructure.
• What attacks cause — financial loss, data theft, privacy violations, service disruption, reputation damage, national security risks.

Name the three foundational goals and define each.

• Confidentiality — only authorized users should access information.
• Integrity — information should not be changed without authorization.
• Availability — systems and information should be available when needed.
• Framing — CIA Triad = Confidentiality + Integrity + Availability, one of the foundational models of cybersecurity.

Separate the three related terms and state the relationship between them.

• Threat — something that can potentially cause harm. Example: a hacker, malware, or a phishing attack.
• Vulnerability — a weakness that can be exploited. Example: a weak password or outdated software.
• Risk — the potential for loss or damage when a threat exploits a vulnerability. Example: the combined danger to the organization.
• Relationship — Threat + Vulnerability → Risk.

Define a cyberattack, list attacker goals and entry points, and name the seven malware types.

• Cyberattack — a deliberate attempt to compromise, damage, disrupt, or gain unauthorized access to a computer system or network.
• Attacker goals — steal information or passwords, damage or disrupt systems, install malware, demand money (extortion), spy on users, gain unauthorized access.
• Entry points — phishing emails, malicious websites, malicious downloads, infected USB drives.
• Malware — malicious software designed to harm, disrupt, spy on, or gain unauthorized access to systems.
• The seven types — Virus, Worm, Trojan, Ransomware, Spyware, Adware, Rootkit.
• Ransomware example — encrypts a victim's files and demands payment for recovery, locking the owner out of their own data with no guarantee the files will ever be restored.

List the ten common cyber threats and define the two human-targeted attack families.

• Ten common threats — malware, phishing, ransomware, password attacks, social engineering, denial-of-service attacks, web attacks, insider threats, data breaches, identity theft. Attack techniques keep evolving.
• Phishing — a social-engineering attack where an attacker pretends to be a trusted person or organization to trick a victim.
• Phishing targets — passwords, credit card information, banking information, personal information, login credentials.
• Phishing mechanism — an urgent message such as an account-closure warning leads to a link, and the link leads to a fake website designed to steal the victim's real login details.
• Social engineering — attacks people rather than relying only on technical vulnerabilities; manipulates victims into revealing passwords, clicking malicious links, downloading malware, sending money, or providing confidential information.
• Common forms — phishing, spear phishing (targeted phishing), pretexting (inventing a false scenario), impersonation, baiting. Key idea: humans can be a target, not just machines.

Define fraud and its detection, then separate authentication from access control.

• Fraud — intentional deception for financial or personal gain. Examples: credit card fraud, banking fraud, insurance fraud, identity theft, online payment fraud.
• Fraud detection in action — a user normally buys from one city; suddenly several unusual transactions occur from different countries within minutes of each other. Security systems analyze transaction and behavior patterns and flag the activity as suspicious for review.
• Authentication — who are you? — verifies your identity. Examples: password, fingerprint, face recognition, security token / one-time code.
• Access control — what can you do? — determines what you are allowed to access. Example: a student can view course materials but cannot modify financial records.
• Pairing — Authentication → Who are you? Authorization → What can you do?

Identify network security technologies and contrast the offensive and defensive disciplines.

• Network security — protects computer networks and the data traveling through them. Technologies: firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), VPNs, encryption, network monitoring.
• Offensive security — finds and exploits security weaknesses, with authorization, before malicious attackers can. Activities: penetration testing, vulnerability assessment, ethical hacking, red teaming, security testing.
• Offensive goal and limit — think like an attacker to identify weaknesses first; professionals must always operate within explicit legal and organizational authorization.
• Defensive security — protects systems and responds to attacks. Activities: monitoring networks, detecting attacks, configuring firewalls, managing vulnerabilities, incident response, malware analysis.
• Defensive goal — prevent, detect, contain, and respond to cyberattacks, keeping systems running safely day to day.
• Side by side — Offensive finds weaknesses, simulates attacks, penetration testing, Red Team, ethical hacking, thinks like an attacker. Defensive protects systems, detects attacks, security monitoring, Blue Team, incident response, thinks like a defender.
• Why both — organizations need to understand how attacks happen AND how they can be prevented or detected.