Machine Learning Construction: implications to cybersecurity
  Statistical learning is the process of estimating an unknown probabilistic
input-output relationship of a system using a limited number of observations; a
statistical learning machine (SLM) is the algorithm, function, model, or rule,
that learns such a process; and machine learning (ML) is the conventional name
of this field. ML and its applications are ubiquitous in the modern world.
Cyberphysical systems such as Automatic target recognition (ATR) in military
applications, computer aided diagnosis (CAD) in medical imaging, DNA
microarrays in genomics, optical character recognition (OCR), speech
recognition (SR), spam email filtering, stock market prediction, etc., are few
examples and applications for ML; diverse fields but one theory. In particular,
ML has gained a lot of attention in the field of cyberphysical security,
especially in the last decade. It is of great importance to this field to
design detection algorithms that have the capability of learning from security
data to be able to hunt threats, achieve better monitoring, master the
complexity of the threat intelligence feeds, and achieve timely remediation of
security incidents. The field of ML can be decomposed into two basic subfields:
\textit{construction} and \textit{assessment}. We mean by \textit{construction}
designing or inventing an appropriate algorithm that learns from the input data
and achieves a good performance according to some optimality criterion. We mean
by \textit{assessment} attributing some performance measures to the constructed
ML algorithm, along with their estimators, to objectively assess this
algorithm.
