2025_EML Capstone Projects

The goal was to demonstrate the early capability of the system to flag outliers. An example of preliminary analysis for normal vs. suspicious behavior as follow:

■ Simulated chart displays average logins vs flagged anomalies, and scatter plot clustering normal vs anomalous sessions. ■ Dataset used for 50 users over 30 days to record daily activities such as logins, file access and privilege escalations. ■ 5 injected anomalies included to simulate suspicious behavior. ■ Unusually high logins, file accesses and escalations are considered injected anomalies. ■ Descriptive stats used to show activities between normal users and potential anomalies.

Back to Table of Contents