Anomaly detection concepts in Cybersecurity - Step-by-Step Execution

Concept Flow - Anomaly detection concepts

Start: Collect Data

↓

Define Normal Behavior

↓

Monitor New Data

↓

Compare New Data to Normal

↓

Is Data Different?

No→Continue Monitoring

Yes↓

Flag as Anomaly

↓

Alert or Investigate

The process starts with collecting data, defining what is normal, then monitoring new data to find differences. If data differs significantly, it is flagged as an anomaly for further action.

Execution Sample

Cybersecurity

normal_behavior = [10, 12, 11, 13, 12]
new_data = 20
threshold = 5
if abs(new_data - sum(normal_behavior)/len(normal_behavior)) > threshold:
    print('Anomaly detected')
else:
    print('Data normal')

This code checks if a new data point is far from the average of normal data to detect an anomaly.

Analysis Table

Step	Action	Value/Condition	Result/Output
1	Calculate average of normal data	average([10,12,11,13,12])	11.6
2	Calculate difference	abs(20 - 11.6)	8.4
3	Compare difference to threshold (5)	8.4 > 5	True
4	Decision	Difference > threshold	Anomaly detected
5	Output	Print message	'Anomaly detected'

💡 Difference exceeds threshold, so data is flagged as anomaly and detection stops.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
normal_behavior	[10,12,11,13,12]	[10,12,11,13,12]	[10,12,11,13,12]	[10,12,11,13,12]	[10,12,11,13,12]
average_normal	N/A	11.6	11.6	11.6	11.6
new_data	20	20	20	20	20
difference	N/A	N/A	8.4	8.4	8.4
threshold	5	5	5	5	5
anomaly_flag	False	False	False	True	True

Key Insights - 3 Insights

Why do we compare the new data to the average of normal data?

Because the average represents typical behavior, so comparing new data to it helps identify if the new data is unusual, as shown in execution_table step 1 and 2.

What does the threshold represent and why is it important?

The threshold sets how different new data must be from normal to be considered an anomaly. It prevents small normal variations from triggering false alarms, as seen in execution_table step 3.

Why do we flag data as anomaly only if difference > threshold?

Because only significant deviations indicate potential problems. Minor differences are normal noise. This decision is shown in execution_table step 4.

Visual Quiz - 3 Questions

Look at the execution_table step 2. What is the calculated difference between new data and average normal?

A 20

B 5

C 8.4

D 11.6

💡 Hint

Check the 'Value/Condition' column in step 2 of execution_table.

At which step does the code decide that the data is an anomaly?

A Step 4

B Step 1

C Step 3

D Step 5

💡 Hint

Look at the 'Result/Output' column to find where the decision is made.

If the threshold was increased to 10, what would happen at step 3?

A Difference would still be greater, anomaly detected

B Difference would be less than threshold, so no anomaly

C Difference would be zero

D Average would change

💡 Hint

Compare difference 8.4 with new threshold 10 in execution_table step 3.

Concept Snapshot

Anomaly detection compares new data to normal behavior.
Calculate a measure (like average) of normal data.
Measure difference between new data and normal.
If difference > threshold, flag anomaly.
Used to find unusual events in cybersecurity.

Full Transcript

Anomaly detection in cybersecurity involves collecting data and defining what normal behavior looks like. New data is monitored and compared to this normal behavior. If the new data differs significantly, beyond a set threshold, it is flagged as an anomaly. This helps identify unusual or suspicious activity. For example, if normal login times average around 11.6, and a new login time is 20, the difference is 8.4. If the threshold is 5, this triggers an anomaly alert. Thresholds help avoid false alarms by ignoring small normal variations. This process is simple but effective for spotting potential security issues.