Attackers can use machine learning in several ways. The first -- and simplest -- is by building their own machine learning environments and modeling their own malware and attack practices to determine the types of events and behaviors looked for by defenders. A sophisticated piece of malware, for example, might modify local system libraries and components, run processes in memory and communicate with one or more domains owned by an attacker's control infrastructure. All these activities in combination create a profile known as tactics, techniques and procedures (TTPs). Machine learning models can observe TTPs and use them to build detection capabilities.

The rapid development of big data techniques has offered great opportunities to develop smart city services in public safety, transportation management, city planning, etc. Meanwhile, the smart city development levels of different cities are still unbalanced. For a large of number of cities which just start development, the governments will face a critical cold-start problem, 'how to develop a new smart city service suffering from data scarcity?'. To address this problem, transfer learning is recently leveraged to accelerate the smart city development, which we term the urban transfer learning paradigm. This article investigates the common process of urban transfer learning, aiming to provide city governors and relevant practitioners with guidelines of applying this novel learning paradigm. Our guidelines include common transfer strategies to take, general steps to follow, and case studies to refer. We also summarize a few future research opportunities in urban transfer learning, and expect this article can attract more researchers into this promising area.