2025_EML Capstone Projects

Milestones included: ● Deployment of behavior scoring algorithm. ● Over 95% detection accuracy validation with 20 simulated anomalies. ● Deployment of interactive dashboard. ● Final report, compliance audit trail, and executive briefing. Deliverables completed:

Synthetic data generation and testing with over 95% anomaly detection accuracy. Behavior scoring algorithms and machine learning model as well as dashboard mock-ups. System architecture was properly documented. Strategies and tools were significantly effective and aligned with project objectives. GitHub was used for version control and collaboration. Finally, compliance and risk management reports were compiled to ensure proper documentation.

5. Data Collection and Analysis Data Sources:

Sources include VA Cybersecurity OIG & GAO reports to identify gaps which are typical incident vectors. Historical user activity logs (login/logout times, file access, privilege escalations), synthetic logs which modeled after typical VA usage to train/test algorithms, and peer-reviewed studies including techniques in anomaly detection, such as clustering, statistical profiling. Lastly, incident reports from VA or other agencies for real-world context. Relevance of data sources is to validate model accuracy against known incidents or synthetic attack and establishing baseline behavior patterns and identifying what deviations look like. Methodology: Data collection: Logins, file access, time of day activities and privilege escalations. The reason why was to establish baseline norms to detect deviations. The approach followed was to simulate benign vs. malicious patterns to ensure model robustness, and lastly. strip personal identifiers, encrypt data at rest & in transit to ensure compliance.

Key Insights: Statistical methods: ■ Descriptive stats (means, standard deviations) on normal user activity. ■ Time-series analysis to spot unusual spikes. ■ Regression or clustering to see which behaviors predict higher risk

Back to Table of Contents