At present, the field of homeland security faces many obstacles while determining abnormal or suspicious entities within the huge set of data. Several approaches have been adopted from social network analysis and data mining; however, it is challenging to identify the objective of abnormal instances within the huge complicated semantic graphs. The abnormal node is the one that takes an individual or abnormal semantic in the network. Hence, for defining this notion, a graph structure is implemented for generating the semantic profile of each node by numerous kinds of nodes and links that are associated to the node in a specific distance via edges. Once the graph structure is framed, the ternary list is formed on the basis of its adjacent nodes. The abnormalities in the nodes are detected by introducing a new optimization concept referred to as biogeography optimization with fitness sorted update (BO-FBU), which is the extended version of the standard biogeography optimization algorithm (BBO). The abnormal behavior in the network is identified by the similarities among the derived rule features. Further, the performance of the proposed model is compared to the other classical models in terms of certain performance measures. These techniques will be useful to detect digital crime and forensics.