Most attacks don’t trigger a rule. They just look slightly off. This lesson teaches unsupervised learning techniques — Isolation Forest, Autoencoders, DBSCAN — to build models that detect behavioral anomalies. You’ll profile normal baselines, set practical thresholds, and work through a hands-on exercise using real network log data.