I tried to make a ML system to detect malware on a network. Kept coming back to what is basically the second and fourth points: Rules and honeypots work better

I tried to make a ML system to detect malware on a network. Kept coming back to what is basically the second and fourth points: Rules and honeypots work better and more simply. A machine learning system will need to learn from something, continuously because malware will adapt to what the model learned previously. Every time you figure out a way to make it classify some traffic as malicious and other traffic not, you're basically writing the rule, except it's like beating a particularly retarded rat brain into figuring out and writing the rule for you. For reference, the 2nd and 4th points are > How do they know their test data is anything like real life data? How do they monitor system performance in the field? > Ask them why they didn't take a simpler approach than the approach they took. Making malware trigger rules is simpler and basically the result of #2.