K-SALP swarm anomaly detection and link prediction based anomaly prevention

Anomaly detection and prevention are critical in various fields, particularly cybersecurity, where early identification and intervention against malicious activities are essential. While traditional studies have predominantly focused on anomaly detection, anomaly prevention has gained increasing importance in identifying and mitigating risks preemptively. This thesis presents a comprehensive framework integrating anomaly detection, prevention, advanced clustering, and nature-inspired algorithms. Our approach leverages the K-medoid clustering method and the Salp Swarm Algorithm for optimal threshold determination. This hybrid method effectively identifies outliers and suspicious nodes within datasets. The framework is applied to real-world datasets, including the widely used Enron email dataset, allowing content-based and node-based anomaly detection. Experimental results demonstrate the success of the proposed method, particularly in the cybersecurity domain, where it outperforms alternative techniques on 5 out of 10 datasets, achieving an AUC value of 0.8651 on the Thyroid dataset. Additionally, the framework introduces a novel concept of "suspicious nodes," identified by data discrepancies between content and structural features. These nodes are labeled for further analysis to prevent potential harmful actions, such as fraudulent behavior or malicious emails. The proposed framework enhances anomaly detection methodologies and pioneers a novel approach to anomaly prevention, offering a proactive solution for mitigating risks before they materialize.