The aim of the course Cybersecurity with AI Tools is for students to become familiar with the artificial-intelligence-based analysis of modern cyber threats, to master supervised, unsupervised, and reinforcement learning as well as neural-network-based anomaly detection methods, and to become capable of applying these in practice on real datasets — complemented by AI-based SIEM, behavioral analytics, and XAI tools.

Lectures

1. Introduction; the intersection of cybersecurity and artificial intelligence (AI); threat landscape. 2. Modern threats: APT (Advanced Persistent Threat), zero-day attacks, attack lifecycle. 3. Supervised learning and classification for anomaly detection. 4. Unsupervised learning (clustering) and identification of outliers. 5. Reinforcement learning in cybersecurity. 6. Neural networks; autoencoders. 7. Convolutional networks; image representation of malware. 8. AI-based SIEM (Security Information and Event Management); predictive analytics. 9. Adversarial ML: data poisoning, evasion, defensive techniques. 10. Behavioral analytics; insider threat detection. 11. Midterm test. 12. Explainable AI (XAI) in decision-making. 13. Retake test (make-up).

Labs

1. Security datasets (e.g. CICIDS, NSL-KDD); threat data exploration, labeling, advanced feature engineering from network flows. 2. APT / zero-day detection pipeline; log correlation and extraction of indicators (IoCs). 3. Intrusion classification with ensemble models; handling class imbalance, hyperparameter tuning, evaluation (ROC/PR curves). 4. Unsupervised anomaly detection on network traffic; Isolation Forest, DBSCAN, threshold calibration, false-positive reduction. 5. Simulation of a reinforcement learning (RL)-based defensive agent (e.g. automated response actions / honeypot policies). 6. Autoencoder-based anomaly detection on network traffic; reconstruction-error-based thresholds. 7. CNN-based malware classification using binary-to-image representation. 8. AI-based SIEM; log aggregation and building predictive alerts. 9. Adversarial ML: generating evasion and data-poisoning attacks, and applying defensive techniques. 10. UEBA (User and Entity Behavior Analytics); modeling user behavior and detecting insider threats. 11. Presentation of the semester project. 12. Explainable AI (XAI); applying SHAP and LIME model explanations on a detection model. 13. Make-up presentation of the semester project.

Lecture slides and study aids are available in Moodle.