AINS6300: AI in Threat Detection

AINS6300: AI in Threat Detection#

Aurnova MSAI track: Cybersecurity AI
Credits: 3
Format: 8-week online graduate course

Applies AI to telemetry, anomaly detection, threat intelligence, detection engineering, and SOC integration.

This course uses the Aurnova delivery model: GitHub Pages provides learner readings and slides, the restricted instructor repository contains teaching and grading materials, and each enrolled learner receives one complete private student repository for all eight modules.

Course Outcomes#

By the end of the course, students will be able to:

  • explain the major concepts and tradeoffs in AI in Threat Detection;

  • build or evaluate applied AI artifacts aligned with the course domain;

  • document assumptions, evidence, limitations, and operational risks;

  • connect technical work to governance, stakeholder needs, and deployment readiness.

Module Map#

  1. Security telemetry and threat models — What signals reveal malicious behavior?

  2. Anomaly detection foundations — How can models detect unknown patterns?

  3. Malware and network behavior analysis — What features distinguish hostile activity?

  4. Threat intelligence and enrichment — How does external intelligence improve detection?

  5. Detection engineering and evaluation — How do we measure detection quality?

  6. Adversarial behavior and evasion — How do attackers adapt to detectors?

  7. Security operations integration — How do detections become action?

  8. Threat detection portfolio — What evidence supports deployment?

::{admonition} Your private student workspace :class: tip

This GitHub Pages site is the learner-facing textbook for AINS6300 AI in Threat Detection. It intentionally does not link to the restricted instructor repository or to graded exercise files.

For hands-on work, return to the current module in Populi and open the private student repository assigned to you. Clone that repository once, or open its Codespace. To use Colab, choose File → Open notebook → GitHub, authorize your private repositories, and select the lab or exercise from your assigned repository.

Complete the work there, commit and push it, and submit exactly what the Populi assignment requests. Populi remains the official source for due dates, submissions, feedback, and grades.

Start Here#

Choose the path that matches your role:

  • Students: begin with How to Use This Course, review each module’s overview, reading, and slides here, then return to Populi and work in the assigned private student repository.

  • Faculty: begin in the restricted Populi faculty area and instructor repository; teaching notes, grading keys, and reference solutions are intentionally absent from this learner site.

  • Technical setup: use Technical Requirements and Setup. Clone your private student repository once or open its Codespace/Colab notebooks; a paid Colab Pro subscription and dedicated local GPU are not required.

  • Readings: use Authoritative Readings and Resources to connect module claims to primary standards, official documentation, and open textbooks.

  • Student workspace: Populi provides the only authoritative link to each learner’s complete private repository; do not use or request access to a course-source or instructor repository.

What Is Interactive?#

The readings and rendered slides are navigable web pages. Interactive labs and exercises are delivered only through each learner’s private student repository; Populi supplies the official repository link, due date, submission, feedback, and grade. “RISE-ready” means a facilitator can open a slide notebook in JupyterLab for presenter mode; students can read the same deck in the browser without installing RISE.