Anomaly detection concepts in Cybersecurity - Mini Project: Build & Apply

Anomaly Detection Concepts

📖 Scenario: You work in a cybersecurity team that monitors network traffic to find unusual activities. Your task is to understand how to identify anomalies in data that might show security threats.

🎯 Goal: Build a simple example that shows how to set up data, define a threshold, detect anomalies, and finalize the detection process.

📋 What You'll Learn

Create a list of network traffic data points with exact values

Define a threshold value to decide what counts as an anomaly

Use a loop to find data points that exceed the threshold

Mark detected anomalies clearly in the final list

💡 Why This Matters

🌍 Real World

Cybersecurity teams monitor network traffic to find unusual patterns that may indicate attacks or breaches.

💼 Career

Understanding anomaly detection helps security analysts identify threats quickly and protect systems.

1

DATA SETUP: Create network traffic data

Create a list called traffic_data with these exact values: 10, 12, 9, 30, 11, 50, 8.

Cybersecurity

# Create the list traffic_data with the given values
# Your code here

Need a hint?

Use square brackets to create a list and separate numbers with commas.

2

CONFIGURATION: Define the anomaly threshold

Create a variable called threshold and set it to 20.

Cybersecurity

traffic_data = [10, 12, 9, 30, 11, 50, 8]
# Define the threshold value
# Your code here

Need a hint?

The threshold is a number that helps decide if a data point is unusual.

3

CORE LOGIC: Detect anomalies in the data

Create an empty list called anomalies. Use a for loop with variable value to go through traffic_data. Inside the loop, add value to anomalies only if value is greater than threshold.

Cybersecurity

traffic_data = [10, 12, 9, 30, 11, 50, 8]
threshold = 20
# Create anomalies list and add values above threshold
# Your code here

Need a hint?

Use append() to add items to a list inside the loop.

4

COMPLETION: Mark anomalies in the original data

Create a new list called marked_data. Use a for loop with variable value to go through traffic_data. Inside the loop, add the string "Anomaly" if value is greater than threshold, otherwise add "Normal".

Cybersecurity

traffic_data = [10, 12, 9, 30, 11, 50, 8]
threshold = 20
anomalies = []
for value in traffic_data:
    if value > threshold:
        anomalies.append(value)
# Create marked_data list to label each value
# Your code here

Need a hint?

This step labels each data point as normal or anomaly for easy understanding.