A parallel algorithm for network traffic anomaly detection based on Isolation Forest

The growth of cyber threats and network traffic has highlighted the need for effective methods for detecting anomalies. The purpose of the study was to develop a hybrid model for detecting anomalies in telecommunications networks with increased accuracy based on comparative analysis of uncontrolled algorithms. Four main algorithms were compared: Isolation Forest, Local Outlier Factor (LOF), One-Class Support Vector Machine (SVM), and Elliptic Envelope using simulated network traffic data. Analysis methods included data normalisation using Z-score and Min-Max Scaling to eliminate large-scale differences between traits. An ensemble of 100 decision trees was used to improve the accuracy of anomaly detection. As a result, it was found that Isolation Forest provided the highest accuracy of anomaly detection (F1-Score = 85.8%) and high processing speed (processing time per 10,000 records in 2.5 seconds), which is important for real-world conditions of telecommunications networks with large amounts of data. LOF showed high accuracy in detecting local anomalies, but with greater computational complexity. The one-class SVM algorithm detected global anomalies, but showed lower accuracy for local ones. Elliptic Envelope had limited performance due to the assumption of normal data distribution. Additionally, a comprehensive model was developed that combined the advantages of Isolation Forest, LOF, and Density-Based Spatial Clustering of applications with Noise, which allowed increasing the F1-Score to 88% and exceeding the results of individual models. The hybrid model showed adaptability to multimodal distributions and efficiency in detecting local anomalies. Practical significance lies in improving the accuracy and stability of network security systems and form the basis for adaptive real-time algorithms, which allowed cybersecurity and telecommunications specialists to more effectively monitor and protect networks from threats

Intrusion Detection Systems (IDS) are integral to ensuring network security. However, in practical settings, network traffic data often exhibits significant imbalances, affecting both labeled and unlabeled data distributions. Such imbalances notably degrade the performance of existing intrusion detection methods, particularly in semi-supervised learning contexts, where traditional approaches struggle to effectively leverage large amounts of unlabeled data for enhanced detection capabilities. This paper introduces a semi-supervised learning approach based on normalizing flows to mitigate the data imbalance issue in network intrusion detection. Normalizing flows construct flexible and invertible probabilistic models that can accurately capture and generate complex, highdimensional network traffic data distributions. Specifically, this method utilizes a small amount of labeled data for initial training and incorporates manifold learning and self-training with unlabeled data to adapt the model to the imbalance in the unlabeled data distribution, thereby improving overall detection performance. Experimental results demonstrate that this method outperforms traditional approaches in addressing data imbalance in intrusion detection. The proposed method not only improves detection accuracy and recall but also significantly reduces reliance on data distribution assumptions, demonstrating robustness and generalization across diverse network traffic datasets.

As explained in Chapter 7, sharing network traffic data has become a vital requirement in machine-learning (ML) algorithms when building an efficient and accurate network traffic classification and intrusion detection system (IDS). However, inappropriate sharing and usage of network traffic data could threaten the privacy of companies and prevent sharing of such data.This chapterpresents aprivacy-preserving strategy-based permutation framework, called PrivTra, in which data privacy, statistical properties, and data-mining utilities can be controlled at the same time. In particular, PrivTra involves the followings: (i) vertically partitioning the original dataset to improve the performance of perturbation; (ii) developing a framework to deal with various types of network traffic data, including numerical, categorical, and hierarchical attributes; (iii) grouping the portioned sets into a number of clusters based on the proposed framework; and (iv) accomplishing the perturbation process by altering the original attribute value with a new value (cluster centroid). The effectiveness of PrivTra is shown through several experiments, such as real network traffic, intrusion detection, and simulated network datasets. Through the experimental analysis, this chapter shows that PrivTra deals effectively with multivariate traffic attributes, produces compatible results as the original data, improves the performance of the five supervised approaches, and provides a high level of privacy protection.

In light of the escalating ubiquity of the Internet, the proliferation of cyber-attacks, coupled with their intricate and surreptitious nature, has significantly imperiled network security. Traditional machine learning methodologies inherently exhibit constraints in effectively detecting and classifying multifarious cyber threats. Specifically, the surge in high-dimensional network traffic data and the imbalanced distribution of classes exacerbate the predicament of ideal classification performance. Notably, the presence of redundant information within network traffic data undermines the accuracy of classifiers. To address these challenges, this study introduces a novel approach for intrusion detection classification which integrates advanced techniques of feature engineering and model optimization. The method employs a feature engineering approach that leverages mutual information maximum correlation minimum redundancy (mRMR) feature selection and synthetic minority class oversampling technique (SMOTE) to process network data. This transformation of raw data into more meaningful features effectively addresses the complexity and diversity inherent in network data, enhancing classifier accuracy by reducing feature redundancy and mitigating issues related to class imbalance and the detection of rare attacks. Furthermore, to optimize classifier performance, the paper applies the Optuna method to fine-tune the hyperparameters of the Catboost classifier, thereby determining the optimal model configuration. The study conducts binary and multi-classification experiments using publicly available datasets, including NSL_KDD, UNSW-NB15, and CICIDS-2017. Experimental results demonstrate that the proposed method outperforms traditional approaches regarding accuracy, recall, precision, and F-value. These findings highlight the method’s potential and performance in network intrusion detection.

Network intrusion detection systems can identify intrusion behavior in a network by analyzing network traffic data. It is challenging to detect a very small proportion of intrusion data from massive network traffic and identify the attack class in intrusion detection tasks. Many existing intrusion detection studies often fail to fully extract the spatial features of network traffic and make reasonable use of temporal features. In this paper, we propose ADFCNN-BiLSTM, a novel deep neural network for network intrusion detection. ADFCNN-BiLSTM uses deformable convolution and an attention mechanism to adaptively extract the spatial features of network traffic data, and it pays attention to the important features from both channel and spatial perspectives. It uses BiLSTM to mine the temporal features from the traffic data and employs the multi-head attention mechanism to allow the network to focus on the time-series information related to suspicious traffic. In addition, ADFCNN-BiLSTM addresses the issue of class imbalance during the training process at both the data level and algorithm level. We evaluated the proposed ADFCNN-BiLSTM on three standard datasets, i.e., NSL-KDD, UNSW-NB15, and CICDDoS2019. The experimental results show that ADFCNN-BiLSTM outperforms the state-of-the-art model in terms of accuracy, detection rate, and false-positive rate.

Robust adaptive multivariate Hotelling's T2 control chart based on kernel density estimation for intrusion detection system

Rapid technological advances and network progress has occurred in recent decades, as has the global growth of services via the Internet. Consequently, piracy has become more prevalent, and many modern systems have been infiltrated, making it vital to build information security tools to identify new threats. An intrusion detection system (IDS) is a critical information security technology that detects network fluctuations with the help of machine learning (ML) and deep learning (DL) approaches. However, conventional techniques could be more effective in dealing with advanced attacks. So, this paper proposes an efficient DL approach for network intrusion detection (NID) using an optimal weight-based deep neural network (OWDNN). The network traffic data was initially collected from three openly available datasets: NSL-KDD, CSE-CIC-IDS2018 and UNSW-NB15. Then preprocessing was carried out on the collected data based on missing values imputation, one-hot encoding, and normalization. After that, the data under-sampling process is performed using the butterfly-optimized k-means clustering (BOKMC) algorithm to balance the unbalanced dataset. The relevant features from the balanced dataset are selected using inception version 3 with multi-head attention (IV3MHA) mechanism to reduce the computation burden of the classifier. After that, the dimensionality of the selected feature is reduced based on principal component analysis (PCA). Finally, the classification is done using OWDNN, which classifies the network traffic as normal and anomalous. Experiments on NSL-KDD, CSE-CIC-IDS2018 and UNSW-NB15 datasets show that the OWDNN performs better than the other ID methods.

Bayesian active learning isolation forest (B-ALIF): A weakly supervised strategy for anomaly detection

GDLC: A new Graph Deep Learning framework based on centrality measures for intrusion detection in IoT networks

The advent of 6G/NextG networks offers numerous benefits, including extreme capacity, reliability, and efficiency. To mitigate emerging security threats, 6G/NextG networks incorporate advanced artificial intelligence algorithms. However, existing studies on intrusion detection predominantly rely on deep neural networks with static components that are not conditionally dependent on the input, thereby limiting their representational power and efficiency. To address these issues, we present the first study to integrate a Mixture of Experts (MoE) architecture for the identification of malicious traffic. Specifically, we use network traffic data and convert the 1D feature array into a 2D matrix. Next, we pass this matrix through a convolutional neural network (CNN) layer, followed by batch normalization and max pooling layers. Subsequently, a sparsely gated MoE layer is used. This layer consists of a set of expert networks (dense layers) and a router that assigns weights to each expert's output. Sparsity is achieved by selecting only the most relevant experts from the full set. Finally, we conduct a series of ablation experiments to demonstrate the effectiveness of our proposed model. Experiments are conducted on the 5G-NIDD dataset, a network intrusion detection dataset generated from a real 5G test network, and the NANCY dataset, which includes cyberattacks from the O-RAN 5G Testbed Dataset. The results show that our introduced approach achieves accuracies of up to 99.96% and 79.59% on the 5G-NIDD and NANCY datasets, respectively. The findings also show that our proposed model offers multiple advantages over state-of-the-art approaches.

Intrusion Detection Systems (IDS) play a vital role in safeguarding modern networks against increasingly complex cyberattacks. However, the presence of high-dimensional, redundant, and noisy features in network traffic data often degrades detection accuracy and scalability. To address this challenge, this paper proposes GSFOIDS (Group Search Based Feature Optimization for Intrusion Detection System), a hybrid framework that integrates Group Search Optimization (GSO) with a Convolutional Neural Network (CNN) for efficient and accurate intrusion detection. Initially, the intrusion dataset is cleaned and preprocessed to remove irrelevant attributes and improve data quality. GSO is then employed to identify an optimal subset of discriminative features using cooperative producer, scrounger, and ranger search strategies. A CNN-based fitness function guides the optimization process by assessing classification accuracy. Experimental results demonstrate that GSFOIDS significantly outperforms existing models across multiple evaluation metrics

The rapid growth of network data has increased the complexity of detecting anomalies, which are crucial for ensuring the security and integrity of information systems. This study investigates the use of the Isolation Forest algorithm for anomaly detection in network traffic, utilizing the Luflow Network Intrusion Detection dataset, which contains 590,086 records with 16 features related to network activities. The methodology encompasses data preprocessing (cleaning, normalization, and feature scaling), feature selection (bytes in, bytes out, entropy, and duration), model training, and performance evaluation. The results demonstrate that Isolation Forest can effectively identify anomalies based on feature patterns, isolating suspicious data points without the need for labeled datasets. However, performance metrics, such as accuracy (42.92%), precision (14.37%), recall (2.87%), and F1-score (4.79%), reveal challenges such as high false-positive rates and low sensitivity to true anomalies. These findings highlight the potential of the algorithm for dynamic, high-dimensional datasets but also indicate the need for further improvements through hyperparameter tuning, feature engineering, and alternative approaches. This study contributes to the development of adaptive anomaly detection frameworks for network security and suggests future integration into real-time systems for proactive threat mitigation. The study's findings are particularly relevant for enhancing network security in environments such as corporate and governmental networks, where real-time anomaly detection is crucial.

Industrial Information Technology infrastructures are often vulnerable to cyberattacks. To ensure security to the computer systems in an industrial environment, it is required to build effective intrusion detection systems to monitor the cyber-physical systems (e.g., computer networks) in the industry for malicious activities. This article aims to build such intrusion detection systems to protect the computer networks from cyberattacks. More specifically, we propose a novel unsupervised machine learning approach that combines the K-Means algorithm with the Isolation Forest for anomaly detection in industrial big data scenarios. Since our objective is to build the intrusion detection system for the big data scenario in the industrial domain, we utilize the Apache Spark framework to implement our proposed model that was trained in large network traffic data (about 123 million instances of network traffic) stored in Elasticsearch. Moreover, we evaluate our proposed model on the live streaming data and find that our proposed system can be used for real-time anomaly detection in the industrial setup. In addition, we address different challenges that we face while training our model on large datasets and explicitly describe how these issues were resolved. Based on our empirical evaluation in different use cases for anomaly detection in real-world network traffic data, we observe that our proposed system is effective to detect anomalies in big data scenarios. Finally, we evaluate our proposed model on several academic datasets to compare with other models and find that it provides comparable performance with other state-of-the-art approaches.

Anomaly detection is essential in applications such as financial fraud detection, network security, and system health monitoring. This study presents a hybrid anomaly detection model for financial transactions, combining the strengths of both unsupervised and supervised learning techniques—Isolation Forest and Random Forest, respectively. the Isolation Forest algorithm, performs unsupervised detection of outliers, effectively identifying rare or irregular data points without requiring labeled input. The detected anomalies are then used to construct a pseudo-labeled dataset, which is subsequently used to train a Random Forest classifier. The Random Forest model learns discriminative patterns between normal and anomalous data, enhancing overall detection capabilities. The system is implemented in Python using Scikit-learn for model development and evaluation. Experiments on benchmark financial transaction "Credit Card Fraud Detection Dataset from Kaggle" The hybrid model achieved a precision of 99.7%, recall of near 100%, and an F1-score of 99.98%, outperforming standalone algorithm The model also improved robustness to noise and better scalability for large datasets. Keywords: Anomaly Detection, Financial Fraud, Hybrid Machine Learning, Supervised Learning, Security, Unsupervised Learning. CISDI Journal Reference Format Azubuike Nnendah Daisy; Anireh, Vincent Ike-Emeka & Sako, D.J.S. (2025): A Model for Anomaly Detection in Financial Transactions using Hybrid Machine Learning Technique. Computing, Information Systems, Development Informatics and Allied Research Journal. Vol 16 No 3, Pp 37-50 Available online at www.isteams.net/cisdijournal. dx.doi.org/10.22624/AIMS/CISDI/V16N3P3

Distributed Denial of Service (DDoS) attack is a serious threat to commercial service network. DDoS attack has been studied for years. However, detecting and relieving DDoS attacks are still a problem. Especially, nowadays more and more DDoS attacks produce heavy network traffic, it is hard to response rapidly because that needs high processing performance to process massive traffic data. With big data technology, volumes of network traffic data can be processed much faster. Apache Spark can process a great amount of data in a reasonable time so that DDoS attack can be detected in time. Besides, it is difficult to modify the network configuration in traditional network. With Software-Defined Networking (SDN), a new paradigm in networking, networking can be controlled by programs, which makes modifying the network configuration easier. In this paper, a DDoS detection and mitigation system framework in SDN is introduced, a framework that can control network based on analyzing the network traffic data. Comparing to the traditional defense methods of DDoS attack, the framework can response to DDoS attack by rules automatically.