Yeah my initial reaction was...wait a second ML is used in info sec. The most obvious examples are intrusion detection and general network analysis. A less glam

Yeah my initial reaction was...wait a second ML is used in info sec. The most obvious examples are intrusion detection and general network analysis. A less glamorous example is pretty much every spam filter (which also filters fishing stuff and is thus very much infosec-relevant). I think false positives are a huge problem in the info sec context and less so in other domains. To give a made up example let's say you have ML-based intrusion detection that is hotwired to some sysadmin pager. Even if your false positive rate is fairly low (at acceptable levels in other domains) with the sheer amount of data a bunch of sysadmin calls will be triggered in sum. That is a huge human factor risk as it most likely will result in teaching admins to ignore certain alerts....which of course opens up the interesting attack vector of understanding/"reversing" the ML and triggering false positives a bunch of times until you want to attack through a channel that will trigger a similar response. Regarding the available data sets: I suppose honeypots/-nets could be created for the purpose of gathering some data sets.