Intermediate

AI for Cybersecurity

Defend digital systems with intelligent security

Build AI-powered threat detection, analyze malware with ML, and defend AI systems — all in isolated cloud Cyber Range labs. 12 weeks of hands-on work spanning ML-based IDS, malware classification, SOC automation, adversarial ML, and ML pipeline security.

Enroll Now — $2,500 See Curriculum
160
Total Hours
12
Weeks
6
Modules
~13
Hrs/Week
📘
47
Topics
💻
11
Coding Exercises
🔬
23
Hands-on Labs
📋
12
Quizzes
📖
12
Readings
💬
13
Forums
🧭
1
Career
Topic
Exercise
Lab
Quiz
Mini Project
Capstone
Activity
Reading
Forum
Career
📡
Live instructor-led delivery · classes run 3 days a week. The topics below are covered in live sessions; recorded versions will be available after class delivery.
MOD 01
Week 1 — Security Fundamentals
Networking, attack vectors, security telemetry, and the Cyber Range setup you will use all course
11h 20m
📘
Networking & TCP/IP Refresher for Security Engineers Topic
OSI model layers, the TCP/IP stack, sockets, protocols students will see in PCAPs all course
1 hr
📘
Attack Vectors — How Adversaries Get In Topic
Phishing, MITM, SQL injection, brute force, credential stuffing, supply-chain attacks
45 min
📘
Network Scanning with Nmap Topic
Host discovery, SYN/connect scanning, service enumeration, NSE scripts, OS fingerprinting
50 min
📘
Security Telemetry Sources & Log Formats Topic
syslog, NetFlow, PCAP, endpoint telemetry; CEF / LEEF / structured JSON conventions
45 min
📖
NIST SP 800-53 Quick Reference for AI Engineers Reading
Self-paced reading on the control families you will reference across the course
30 min
💻
Coding Exercise — Parse PCAP Files with Scapy Exercise
Filter packets by protocol, extract conversation flows, plot top-talkers from a sample capture
1h 30m
💬
Discussion — What Is Your Threat Model? Forum
Share a brief writeup describing the threats most relevant to your current or target role
30 min
🔬
Lab 1 — Stand Up Your Cyber Range Lab 🧪 Cyber Range Lab · Intermediate
6-step lab: provision attacker, target, and monitoring VMs; configure private subnet; run Nmap SYN scan; capture traffic; parse XML output
2h 30m
🔬
Lab 2 — Vulnerability Assessment + Structured Findings Report Lab 🧪 Cyber Range Lab · Intermediate
Run OpenVAS scan against Metasploitable, parse XML, enrich with CVSS v3.1 scores, generate executive Markdown report
2h 30m
📋
Week 1 Knowledge Check Quiz
25-question quiz covering protocols, scanning concepts, and telemetry sources
30 min
MOD 02
Week 2 — Threat Intelligence
MITRE ATT&CK, kill chains, IoCs, and the parsing pipelines that feed downstream ML models
12 hrs
📘
MITRE ATT&CK — Tactics, Techniques, and Procedures Topic
Tactic columns, technique IDs, sub-techniques, the matrices for Enterprise / Mobile / ICS
1 hr
📘
Lockheed Martin Cyber Kill Chain Topic
Seven phases from recon to actions on objectives, how to map kill chains to your detection coverage
45 min
📘
Indicators of Compromise — Atomic, Computed, Behavioral Topic
File hashes, IP/domain reputation, URL patterns, behavioral IoCs and their relative half-lives
45 min
📘
STIX 2.1 and TAXII — How Intel Travels Topic
Object types, relationship objects, TAXII servers and discovery — the wire format of threat intel
45 min
📖
Reading — A Year of APT Reports Reading
Skim three recent APT writeups; map each campaign to ATT&CK techniques
45 min
💻
Exercise — Write Grok Patterns for Three Log Formats Exercise
Build Grok patterns for syslog auth.log, Apache combined, and Cisco firewall logs; validate against samples
1h 30m
💬
Discussion — Which IoCs Decay Fastest? Forum
Rank atomic vs computed vs behavioral IoCs by useful lifetime; defend your ordering
30 min
🔬
Lab 1 — Multi-Source Log Parser with Event Correlation Lab 🧪 Cyber Range Lab · Intermediate
Collect auth + Apache + firewall logs into a unified JSON schema; correlate failed SSH with subsequent firewall denies to find brute-force runs
3 hrs
🔬
Lab 2 — Map a Simulated Attack to MITRE ATT&CK Lab 🧪 Cyber Range Lab · Intermediate
Execute multi-stage attack scenario, collect logs + PCAPs, map each phase to ATT&CK IDs, extract IoCs as STIX 2.1 objects
2h 30m
📋
Week 2 Knowledge Check Quiz
25 questions on ATT&CK, kill chain, IoC types, and STIX
30 min
MOD 03
Week 3 — Anomaly Detection for IDS
Statistical and ML-based intrusion detection on real network-flow datasets
11h 50m
📘
Statistical Anomaly Detection — Z-score, IQR, EWMA Topic
When each method fits, threshold selection, and why most production IDS still ships z-scores
50 min
📘
ML-Based IDS Architecture Topic
Feature pipeline → model → scoring → alerting loop; offline training vs streaming inference tradeoffs
50 min
📘
Feature Engineering from Network Flows Topic
Flow duration, byte/packet ratios, TCP flag counts, inter-arrival timings, port entropy
55 min
📘
Evaluation Metrics for IDS — Why Accuracy Lies Topic
Detection rate, false positive rate, precision/recall, F-beta, and the cost of a 0.5% FPR at scale
45 min
📖
Reading — CIC-IDS Dataset Documentation Reading
Read the dataset companion paper end-to-end; note attack categories and label distribution
30 min
💻
Exercise — Implement SMOTE for Class Imbalance Exercise
Hand-code a SMOTE oversampler from scratch, then compare against imbalanced-learn
1h 30m
💬
Discussion — Supervised vs Unsupervised IDS in Production Forum
Which approach would you trust for a production deployment, and why?
30 min
🔬
Lab 1 — ML-Based IDS on CIC-IDS Dataset Lab 🧪 Jupyter Notebook Lab · Intermediate
Load CIC-IDS2017, clean + engineer features, apply SMOTE, train RF + XGBoost, compare detection rate vs FPR; confusion matrix per attack family
3 hrs
🔬
Lab 2 — Unsupervised Anomaly Detection for Zero-Days Lab 🧪 GPU Training Lab · Advanced
Train autoencoder + Isolation Forest on benign-only traffic; tune anomaly thresholds for target FPR; KS-test concept-drift detector
2h 30m
📋
Week 3 Knowledge Check Quiz
25 questions on anomaly detection methods, metrics, and feature engineering
30 min
MOD 04
Week 4 — Traffic Analysis & UEBA
Deep packet inspection, user behavior profiling, and lateral movement detection
11h 45m
📘
DPI vs Flow Analysis — When to Reach for Each Topic
Encrypted traffic, performance budgets, what gets lost at each layer
45 min
📘
User Behavior Profiling Fundamentals Topic
Login patterns, resource access frequency, peer-group baselines, weekend vs weekday signals
50 min
📘
UEBA Risk Scoring — Combining Signals Topic
Multiplicative vs additive scores, decay functions, suppression rules, alert-fatigue tradeoffs
50 min
📘
Lateral Movement Detection — East-West Anomalies Topic
Service-account abuse, pass-the-hash, golden ticket attacks and the network signatures they leave
50 min
📖
Reading — Real-World UEBA Failure Case Studies Reading
Two writeups on UEBA programs that drowned in false positives — what we learn
30 min
💻
Exercise — Session Reconstruction from Flow Logs Exercise
Group raw flow records into application sessions using timing + IP/port heuristics
1h 30m
💬
Discussion — Insider Threat: Detection vs Privacy Forum
Where do you draw the line between behavioral monitoring and workplace surveillance?
30 min
🔬
Lab 1 — DNN Traffic Classifier on PCAPs Lab 🧪 GPU Training Lab · Advanced
Extract flow features with CICFlowMeter, normalize + select features, train 3-layer DNN with early stopping; ROC-AUC + detection latency
3 hrs
🔬
Lab 2 — UEBA Insider-Threat Detector with Isolation Forest Lab 🧪 Jupyter Notebook Lab · Intermediate
Build per-user behavioral profiles, train Isolation Forest, implement risk scoring with privilege weighting, validate with insider-threat sim
2h 30m
📋
Week 4 Knowledge Check Quiz
25 questions on DPI, UEBA, risk scoring, and lateral movement
30 min
MOD 05
Week 5 — Static Malware Analysis
PE file internals, YARA, feature extraction, and the ML classifier you will train on real samples
12 hrs
📘
The PE File Format Up Close Topic
DOS header, PE header, section table, import/export tables, anchor offsets attackers tamper with
1 hr
📘
Feature Extraction — Byte n-grams, API Calls, Strings Topic
Choosing features that survive obfuscation, vocabulary explosion management
50 min
📘
Packing Detection via Entropy Analysis Topic
UPX, Themida, custom packers; section-level entropy thresholds and shortcomings
45 min
📘
Writing Production-Grade YARA Rules Topic
Pattern syntax, conditions, modules, performance considerations, false-positive triage workflow
55 min
📖
Reading — Sandbox Evasion Techniques in Modern Malware Reading
Timing checks, environment detection, anti-debug tricks samples use to defeat dynamic analysis
30 min
💻
Exercise — Extract PE Header Fields with pefile Exercise
Parse 50 PE samples, extract 20+ header features, output as CSV ready for ML
1h 30m
💬
Discussion — When Does Static Analysis Stop Working? Forum
Identify two real malware families where static features fail and why
30 min
🔬
Lab 1 — Static-Feature Malware Classifier Lab 🧪 Cyber Range Lab · Advanced
Combine PE header features + byte entropy + string n-grams; write 3 YARA rules; train gradient-boosting classifier with full metrics
3 hrs
🔬
Lab 2 — Detonate Samples in a Cuckoo Sandbox Lab 🧪 Cyber Range Lab · Advanced
Stand up Cuckoo with snapshotted Windows VMs, submit 30 samples, extract behavioral n-grams + dynamic features, train XGBoost vs static baseline
2h 30m
📋
Week 5 Knowledge Check Quiz
25 questions on PE format, feature extraction, packing, and YARA
30 min
MOD 06
Week 6 — ML-Based Malware Classification
CNNs on binary-as-image, RNNs on API sequences, and NLP-based phishing detection
12h 20m
📘
Malware Visualization — Binary as Grayscale Image Topic
Why this trick works, image-size choices, family-level visual patterns
45 min
📘
CNN Architectures for Malware Image Classification Topic
Designing a CNN for fixed-size binary images, data augmentation strategies that actually help
55 min
📘
RNNs + Attention on API Call Sequences Topic
Sequence modeling for behavioral data, choosing between LSTMs, GRUs, and transformer-style attention
55 min
📘
Concept Drift in Malware Families Topic
Why your model decays in production, monitoring strategies, retraining cadence
45 min
📖
Reading — Phishing Detection Beyond URL Heuristics Reading
Review of header-based, content-based, and URL-based phishing features
30 min
💻
Exercise — Augment Malware Binary Images Exercise
Implement rotation, flipping, gaussian noise; measure effect on family classification accuracy
1h 30m
💬
Discussion — Multi-Class vs Binary Detection Forum
When is family classification worth the extra labeling cost?
30 min
🔬
Lab 1 — CNN Malware Family Classifier Lab 🧪 GPU Training Lab · Advanced
5-step lab: convert binaries to 256×256 grayscale, stratified split, train 3-block CNN on GPU with augmentation, per-family report + confusion matrix
3 hrs
🔬
Lab 2 — NLP Phishing Email Detector Lab 🧪 Jupyter Notebook Lab · Intermediate
Header features (SPF/DKIM, sender age), URL features (domain length, redirects), TF-IDF body content; logistic baseline vs fine-tuned BERT
3 hrs
📋
Week 6 Knowledge Check Quiz
25 questions on CNNs for malware, RNNs for sequences, concept drift, and phishing features
30 min
MOD 07
Week 7 — Automated Log Analysis
Elastic SIEM, detection-rule authoring, anomaly scoring, and automated alert prioritization
12h 20m
📘
Log Ingestion Pipelines with Filebeat + Logstash Topic
Shippers, transforms, parsers; designing pipelines that survive log-format changes
50 min
📘
Elastic SIEM — Index Patterns and Detection Rules Topic
Time-based indices, detection rule types, rule scheduling, performance tuning
50 min
📘
Anomaly Scoring on Log Streams Topic
Window-based statistics, rule-based vs ML-based scoring, false-positive suppression
50 min
📘
Alert Prioritization & Enrichment Topic
Severity × confidence × asset criticality; GeoIP + threat-feed correlation; asset-tagging strategies
50 min
📖
Reading — Sigma Rules: The Open Detection Language Reading
Sigma rule structure, conversion targets, the maturing rule-sharing ecosystem
30 min
💻
Exercise — Write a Log Anomaly Scoring Library Exercise
Build a Python lib that computes rolling z-scores per event-type and emits alerts past threshold
1h 30m
💬
Discussion — How Many Alerts Per Day Per Analyst? Forum
Share your team's reality vs aspirational alert volume — what tuning got you closer?
30 min
🔬
Lab 1 — Elastic SIEM End-to-End Lab 🧪 Cyber Range Lab · Advanced
Stand up Elastic + Kibana, ship logs via Filebeat, write Logstash Grok filters, author 3 detection rules, integrate Python anomaly scorer, verify on simulated attack
3h 30m
🔬
Lab 2 — Sigma Rules from APT PCAPs Lab 🧪 Jupyter Notebook Lab · Advanced
Take 5 Malware-Traffic-Analysis PCAPs, identify TTPs → MITRE IDs, author Sigma rules in YAML, convert to Elastic DSL, measure detection coverage
2h 30m
📋
Week 7 Knowledge Check Quiz
25 questions on ingestion pipelines, SIEM rules, anomaly scoring, prioritization
30 min
MOD 08
Week 8 — LLMs for Security Operations
Using language models for alert triage, report generation, and SOAR playbook automation
12h 25m
📘
LLMs in the SOC — Where They Actually Help Topic
Triage, summarization, report drafting; what to never trust an LLM with
50 min
📘
Prompt Templates for Alert Triage Topic
System / user prompt design, structured output enforcement, few-shot examples, eval rigor
55 min
📘
LLM-Assisted Code Review for Vulnerability Detection Topic
Where LLMs catch real bugs, what they miss, how to integrate with existing SAST tools
50 min
📘
SOAR Playbook Design — Triggers, Conditions, Actions Topic
Designing playbooks that auto-respond safely, kill-switch patterns, rollback workflows
50 min
📖
Reading — Auto-Isolation: When It Saves You vs Hurts You Reading
Case studies on autonomic response done well and done badly
30 min
💻
Exercise — Evaluate LLM Triage Quality Exercise
Build a triage-eval harness with human-labeled ground truth and compute agreement metrics
1h 30m
💬
Discussion — Trust Boundary for LLM Actions Forum
Which SOAR actions would you let an LLM trigger unsupervised, and which would always need a human?
30 min
🔬
Lab 1 — LLM-Powered Security Analyst Assistant Lab 🧪 Jupyter Notebook Lab · Intermediate
Process 20 raw alerts through an LLM triage pipeline; structured severity + IoC + action extraction; threat-report generator in Markdown
3 hrs
🔬
Lab 2 — SOAR Playbook with Auto-Isolation Lab 🧪 Cyber Range Lab · Advanced
Define playbook schema, write orchestration script, implement firewall-API host isolation + Slack notification; verify response in <60s
3 hrs
📋
Week 8 Knowledge Check Quiz
25 questions on LLM triage, prompts, SOAR design, automated response
30 min
MOD 09
Week 9 — Adversarial Attacks
Evasion, poisoning, model extraction — attacking the ML systems we just built
12h 35m
📘
Threat Model for ML Systems Topic
Attack surfaces across training and inference, adversary capabilities, goals, knowledge levels
50 min
📘
Evasion Attacks — FGSM, PGD, Carlini-Wagner Topic
Gradient-based perturbations, L∞/L2 constraints, why iterative attacks beat single-step
1 hr
📘
Training-Data Poisoning and Backdoors Topic
Clean-label poisoning, backdoor triggers, why poisoning gets harder with model scale
55 min
📘
Model Extraction & Membership Inference Topic
Stealing decision boundaries via query access, reconstructing training-set membership
50 min
📖
Reading — Adversarial Patches in the Physical World Reading
Stop-sign attacks, glasses that fool face recognition — what works outside a lab
30 min
💻
Exercise — Implement FGSM From Scratch Exercise
Hand-code the FGSM attack against a CIFAR-10 model; verify against an established library
1h 30m
💬
Discussion — Threat Model for Your Own System Forum
Describe an adversary that worries you most about a system you actually maintain
30 min
🔬
Lab 1 — Evasion Attacks vs ResNet-50 Lab 🧪 GPU Training Lab · Advanced
FGSM + 20-iteration PGD vs pre-trained ResNet-50; measure attack success rate; test transferability to VGG-16; targeted attack on a stop sign
3 hrs
🔬
Lab 2 — Poisoning + Backdoor + Extraction Chain Lab 🧪 GPU Training Lab · Advanced
Poison Week-5 PE classifier at 1/5/10% rates; design backdoor trigger; verify 95% backdoor success; build a surrogate via model extraction
3 hrs
📋
Week 9 Knowledge Check Quiz
25 questions on evasion, poisoning, extraction, and transferability
30 min
MOD 10
Week 10 — Adversarial Defense
Adversarial training, input preprocessing, certified robustness, and red-team / blue-team
12h 20m
📘
Adversarial Training Methodology Topic
Generating adversarial examples on-the-fly during training, batch composition strategies
55 min
📘
Input Preprocessing Defenses & Their Limits Topic
Gaussian smoothing, JPEG compression, spatial squeezing — and the adaptive attacks that break them
45 min
📘
Certified Robustness via Randomized Smoothing Topic
Smoothing-based certificates, how to read robustness radii, computational cost in practice
55 min
📘
Ensemble Defenses and Diversity Strategies Topic
Majority voting, model diversity metrics, why ensemble defenses sometimes hurt
45 min
📖
Reading — Red Team / Blue Team Programs for ML Systems Reading
How mature teams structure adversarial assessments — rules of engagement, reporting
30 min
💻
Exercise — Build a Defense Evaluation Harness Exercise
Reusable test rig that measures clean accuracy + FGSM/PGD accuracy across defense configurations
1h 30m
💬
Discussion — Defense in Depth for ML Forum
Stack two defenses you would always combine, and explain why they cover each other's gaps
30 min
🔬
Lab 1 — Adversarial Training Robustness Measurement Lab 🧪 GPU Training Lab · Advanced
Retrain ResNet-50 with PGD adversarial training; measure clean vs adversarial accuracy; compare against preprocessing defenses; write tradeoff report
3 hrs
🔬
Lab 2 — Red Team / Blue Team on the Week-3 IDS Lab 🧪 Cyber Range Lab · Advanced
Deploy IDS as live service; red team crafts evasive flows + extraction queries; blue team monitors + tunes thresholds; joint after-action report
3 hrs
📋
Week 10 Knowledge Check Quiz
25 questions on adversarial training, preprocessing, certified robustness, ensembles
30 min
MOD 11
Week 11 — ML Pipeline Security
Supply-chain risk, model signing, secure serving, differential privacy, federated learning
12h 25m
📘
Supply Chain Risks in the ML Pipeline Topic
Compromised dependencies, poisoned pre-trained weights, training-data provenance gaps
50 min
📘
Model Signing & Verification Topic
Cryptographic model integrity, signing workflows from training through deployment
45 min
📘
Secure Model Serving — Auth, Encryption, Input Validation Topic
AuthN/Z patterns, mTLS, rate limiting, payload-size limits, prompt-injection defenses
55 min
📘
Differential Privacy Fundamentals Topic
ε-δ guarantees, sensitivity calibration, DP-SGD, the privacy-accuracy tradeoff
55 min
📖
Reading — Federated Learning in the Wild Reading
Privacy benefits, communication costs, why it has not displaced centralized training
30 min
💻
Exercise — Audit a Requirements.txt for CVE Vulnerabilities Exercise
Wire up pip-audit + safety against a deliberately stale requirements file; produce remediation plan
1h 30m
💬
Discussion — Whose Privacy Budget Is It Anyway? Forum
When should the privacy budget be per-user, per-query, or per-deployment?
30 min
🔬
Lab 1 — Full ML Pipeline Security Audit Lab 🧪 Cyber Range Lab · Advanced
Inventory components + dependencies; CVE scan; test serving endpoint for injection + auth bypass; categorized severity report with remediation
3 hrs
🔬
Lab 2 — Differential Privacy with Opacus Lab 🧪 GPU Training Lab · Advanced
Train baseline → DP-SGD at ε = 1.0 / 5.0 / 10.0 with per-sample gradient clipping; privacy-accuracy curve; membership-inference attack pre vs post
3 hrs
📋
Week 11 Knowledge Check Quiz
25 questions on supply chain, model signing, secure serving, DP, federated learning
30 min
MOD 12
Week 12 — Compliance & Capstone
NIST AI RMF, SOC 2, GDPR, and the end-to-end capstone project
18h 20m
📘
NIST AI Risk Management Framework Topic
Govern, Map, Measure, Manage functions; how to actually run an AI risk assessment
1 hr
📘
SOC 2 + GDPR Considerations for ML Systems Topic
Right to erasure, automated decision-making, audit trails, vendor-management implications
55 min
📘
Designing an End-to-End AI Security System Topic
Integrating detection + response + monitoring; component coupling and failure modes
55 min
📖
Reading — Incident Response Playbook for AI-Related Events Reading
Classification taxonomy, escalation paths, post-incident review template
30 min
💬
Capstone Peer Review Forum
Review two peers' capstone submissions using the provided rubric
1 hr
💬
Showcase — Present Your Capstone Forum
Share your design, results, and the most interesting failure you debugged
45 min
🧭
Career Outcomes Roundup — AI Security Roles Career
AI Security Engineer / Threat Intel Analyst / Security Data Scientist / ML Security Researcher pathways
30 min
🔬
Capstone — Comprehensive AI-Powered Security System Lab 🧪 Cyber Range Lab · Advanced
7-step capstone: design architecture (data sources + ML models + workflows); deploy IDS + UEBA; integrate SOAR auto-isolation; audit trail; multi-stage attack test; compliance assessment vs NIST AI RMF; final project report + presentation
12 hrs
📋
Final Course Assessment Quiz
40 questions covering all 12 weeks of material; 75% passing score
45 min

Take this course with you

The full curriculum, outcomes, hands-on labs and pricing — in one beautiful PDF to read offline or share with your team.

Learn with a cohort — live Zoom sessions, Q&A, and lifetime access to recordings.

upcoming

AI for Cybersecurity — July Cohort 2026

Instructor: AI Labs Instructor
  • 📅Jul 15, 2026 – Oct 6, 2026
  • 🕐Tuesdays & Thursdays, 7–9 PM CST
$2,500
upcoming

AI for Cybersecurity — July Cohort 2026

Instructor: AI Labs Instructor
  • 📅Jul 27, 2026 – Sep 6, 2026
  • 🕐Tuesdays & Thursdays, 7–9 PM CST
$2,500
Ready to start?

$2,500

Online lectures + Cyber Range lab + Red/blue team exercises

Choose payment option

Frequently asked questions about this program

What level is the AI for Cybersecurity program? +
Intermediate. Total program length is 12 Weeks (160+ Hours of combined live instruction and lab time).
What prerequisites do I need? +
Python proficiency; Basic networking knowledge; Familiarity with ML concepts
Does this course include hands-on lab work? +
Yes. This program includes hands-on lab time in 3 cloud lab environments provisioned by AI Labs. Every student gets a personal cloud workspace plus on-prem workstation access at our Houston Training Center.
Is this delivered online or in person? +
Both. The default delivery is Online lectures + Cyber Range lab + Red/blue team exercises. In-person sessions are available at our Houston Training Center for any student who prefers on-site delivery.
What roles does this program prepare me for? +
AI Security Engineer, Threat Intelligence Analyst, Security Data Scientist, ML Security Researcher.
Do I receive a certificate at the end? +
Yes. Every program ends with a capstone project and a verifiable AI Labs completion certificate. Certificates are issued via our LMS and include the capstone work as a portfolio link.
How much does the program cost and are payment plans available? +
Program tuition is $2,500. Most students use our 2-installment plan (50% at enrollment, 50% midway through). Enterprise + nonprofit pricing is available — contact us for a quote.

Labs used in this course

Hands-on environments you'll spin up during the program.

Related courses

Other AI Labs programs that share lab environments with this one.