Network Encryption Traffic Anomaly Detection Based on Integrated Machine Learning

The article examines the problem of detecting anomalies in the network traffic of information systems of organizations. Detection of anomalies in network traffic will allow to determine the hidden malicious activity of the data obtained on the basis of protocols that collect statistical data of the network traffic of the information system. This, in turn, will allow you to reduce the load and configure the attributes that will be used to monitor and analyze network traffic. The authors proposed the network traffic anomaly detection architecture, which is divided into functional levels. Protocols were analyzed to collect statistics, namely the Net Flow/IPFIX protocol, which provides comprehensive information based on packet headers. To process and analyze the received data, the authors developed a model for detecting anomalies in the traffic of the information system. The anomaly detection model uses statistical data for their further processing, as well as the possibility of storing data in a repository. All received data is filtered to detect malicious processes, transferred and stored in the repository of the attack database with the possibility of creating warnings and identifying the attack. For the specified model, the use of Machine Learning based on methods of predicting categorical fields is proposed. The work used a dataset with firewall data, which contains information on the number and size of transmitted and received packets of packets, data on the use of malicious software. Using the method, an experimental study of the data was conducted to predict the presence of malicious software in them. The method of forecasting categorical fields using Logistic Regression, SVM, Random Forest Classifier and other classification algorithms was investigated. Based on the obtained data, a confusion matrix was built, which allows to estimate the error of the algorithms.

The proliferation of Azolla filiculoides, a fast-growing invasive aquatic fern, threatens river ecosystems worldwide by altering water quality and outcompeting native species. This study presents a novel approach for the global detection of A. filiculoides using Sentinel-2 satellite imagery and Random Forest classification within the Google Earth Engine (GEE) platform.We utilized the high-resolution spectral data from Sentinel-2 to capture the unique reflectance characteristics of A. filiculoides. A Random Forest classifier, trained with ground-truth data from multiple riverine environments, was applied to distinguish A. filiculoides from other aquatic vegetation and surface water features. The robustness of the model was tested across time to ensure broad applicability. The method was tested and validated on the Tagus River (Spain) with manually labeled speies observations over several years.The primary objective is to develop a scalable and user-friendly GEE application that enables near real-time monitoring and detection of A. filiculoides in river systems globally. This app is designed to support environmental managers and policymakers by providing accessible tools for early detection and effective management of this invasive species as well as to provide large scale species distribution data to leverage biogeogeographic studies of A. filiculoides.Preliminary results demonstrate high classification accuracy (R² = 0.94) and the potential for the GEE app to facilitate large-scale monitoring. By integrating machine learning with cloud computing, our approach offers a cost-effective and efficient solution for the global challenge of invasive aquatic plant detection.

The development of Internet and network applications has brought the development of encrypted communication technology. But on this basis, malicious traffic also uses encryption to avoid traditional security protection and detection. Traditional security protection and detection methods cannot accurately detect encrypted malicious traffic. In recent years, the rise of artificial intelligence allows us to use machine learning and deep learning methods to detect encrypted malicious traffic without decryption, and the detection results are very accurate. At present, the research on malicious encrypted traffic detection mainly focuses on the characteristics’ analysis of encrypted traffic and the selection of machine learning algorithms. In this paper, a method combining natural language processing and machine learning is proposed; that is, a detection method based on TF-IDF is proposed to build a detection model. In the process of data preprocessing, this method introduces the natural language processing method, namely, the TF-IDF model, to extract data information, obtain the importance of keywords, and then reconstruct the characteristics of data. The detection method based on the TF-IDF model does not need to analyze each field of the data set. Compared with the general machine learning data preprocessing method, that is, data encoding processing, the experimental results show that using natural language processing technology to preprocess data can effectively improve the accuracy of detection. Gradient boosting classifier, random forest classifier, AdaBoost classifier, and the ensemble model based on these three classifiers are, respectively, used in the construction of the later models. At the same time, CNN neural network in deep learning is also used for training, and CNN can effectively extract data information. Under the condition that the input data of the classifier and neural network are consistent, through the comparison and analysis of various methods, the accuracy of the one-dimensional convolutional network based on CNN is slightly higher than that of the classifier based on machine learning.

The rapid growth of global air cargo demand has intensified the need for more efficient and intelligent storage allocation within airport cargo terminals. Traditional static allocation and rule-based systems struggle to adapt to dynamic cargo flows, leading to operational inefficiencies. This study aims to develop a hybrid decision support system that optimizes storage allocation by integrating machine learning and multicriteria decision-making techniques. A Random Forest Classifier was trained using historical cargo data, including weight, quantity, size, priority, and cargo type, to predict optimal storage zones. To enhance interpretability and expert control, the Analytic Hierarchy Process AHP was used to derive feature weights, while the Technique for Order Preference by Similarity to Ideal Solution (TOPSIS) was employed to rank the best storage alternatives. The model was tested on real-world data from Almaty International Airport involving 1,500 cargo orders. Results show that the system reduced average storage time by 14%, minimized cargo redistributions by 22%, increased storage density by 9%, and improved on-time delivery for priority cargo by 17% compared to traditional FIFO-based methods. The integration of data-driven learning with expert judgment offers a robust and transparent decision-making framework. These improvements confirm the value of combining machine learning with AHP–TOPSIS methods in logistics operations. This system presents significant implications for airport terminal managers seeking to enhance operational throughput, academic researchers exploring hybrid intelligent systems, and policymakers promoting digital logistics infrastructure. Future studies may include adaptive learning, seasonal cargo flow modelling, and digital twin-based scenario testing to further generalize the solution.

The aim of this study was to identify and validate clinically meaningful predictors of local treatment failure (LTF) after stereotactic radiotherapy (SRT) for brain metastases by integrating machine learning (ML)-based feature selection with generalized linear mixed-effects modeling (GLMM). The retrospective study included 211 brain metastases from 63 patients treated with SRT. Each lesion was investigated independently, considering the within-patient clustering. Random forest classifiers were trained using a 3-fold cross-validation repeated 100 times to assess predictive performance and feature importance. The predictors included age, lesion length, biological effective dose (BED), sex, post-SRT systemic therapy, Karnofsky Performance Status (KPS), type of primary tumor, and lesion location. Features with high importance were further evaluated using GLMM to determine statistical significance. Receiver operating characteristic (ROC) analysis was performed to determine optimal thresholds and diagnostic accuracy. The median duration of follow-up was 232 days, and 31 lesions (14.7%) developed LTF following SRT. The ML model achieved a mean area under the ROC curve (AUC) of 0.88 and an accuracy of 0.84. Variable importance rankings identified age, primary tumor, BED, length, and KPS. The GLMM confirmed associations of lower BED (odds ratio [OR] = 0.89, 95% confidence interval [CI] = 0.80-0.98; P = .023) and greater lesion length (OR = 1.16, 95% CI = 1.08-1.24; P < .001) with LTF. The ROC analysis identified BED ≤60.0 Gy (AUC = 0.72; sensitivity = 0.81; specificity = 0.71) and lesion length ≥19.3 mm (AUC = 0.78; sensitivity = 0.58; specificity = 0.88) as thresholds. Lesion length was the most robust predictor of LTF after SRT, with a length ≥19.3 mm indicating increased risk.

Abstract: This paper focuses on understanding and solving the problem of phishing websites. Phishing is a type of cyber attack that creates fake websites and URLs that look like real people and tricks people into sharing sensitive information, such as passwords or financial details. These attacks target unsuspecting users and can have serious consequences. In this study, we discuss how AI can help identify and prevent phishing websites. We also explore different AI models that could create smarter, more effective anti-phishing systems in the future. While phishing is quite a common problem, no single method can address all the vulnerabilities. Instead, an amalgamation of techniques is often needed to combat different types of attacks. Machine learning, in particular, is a powerful tool that can mitigate phishing attempts and ensure online safety for everyone. As technology advances, phishing approaches are becoming more sophisticated and often outpacing the potency of present antiphishing tools, which often have limitations. This paper explores how to use machine learning controls to combat phishing. The goal is to create an efficient, accurate, and effective system. To achieve this, we use four machine learning models: K- Nearest Neighbors (KNN), Kernel-SVM, Random Forest Classifier, and Decision Tree. These models rely on labeled datasets to learn and improve their ability to detect phishing attempts. Each of these algorithms brings unique strengths to the classification process, helping to identify and prevent malicious activity. Machine learning allows cybersecurity systems to analyze patterns, adapt to new threats, and take proactive steps to stop future attacks. By integrating machine learning into security, we can take important steps to protect users from these attacks

Integrating machine learning (ML) models into healthcare systems is a rapidly evolving field with the potential to revolutionize care delivery. This study aimed to classify fertility rates and identify significant predictors using ML models among reproductive women in Ethiopia. This study utilized eight ML models in 5864 reproductive-age women using Ethiopian Demographic Health Survey (EDHS), 2019 data. Phyton programming language was used to develop these models. Predictors of fertility rate were determined using the feature important techniques. The performance of models was evaluated using accuracy, area under the curve (AUC), precision, recall, F1-score, specificity, and sensitivity. The mean age of participants was 32.7 (± 5.6) years. The random forest classifier (accuracy = 0.901 and AUC = 0.961) followed by a one-dimensional convolutional neural network (accuracy = 0.899 and AUC = 0.958), logistic regression (accuracy = 0.874 and AUC = 0.937), and gradient boost classifier (accuracy = 0.851 and AUC 0.927) were the top performing ML models. Family size, age, occupation, and education with an average importance score of 0.198, 0.151, 0.118, and 0.081, respectively were the top significant predictors of the fertility rate. The best ML models to classify and predict fertility rates were random forest, one-dimensional convolutional neural network, logistic regression, and gradient boost classifier. The findings on important factors of fertility rate can inform targeted public health, programs that address disparities related to family size, occupation, education, and other socioeconomic factors.

Ovarian cancer is one of the leading causes of cancer-related deaths among women, primarily due to late- stage diagnosis and the absence of early symptoms. This study aims to enhance diagnostic accuracy using clinical data, biomarkers, and ultrasound imaging by leveraging machine learning techniques, including decision trees, k-nearest neighbors (KNN), and random forest classifiers. Our proposed method achieves high diagnostic accuracy, with the random forest model reaching 93%, followed by decision tree and KNN under specific parameter settings. This non- invasive and scalable approach minimizes false negatives and enhances diagnostic confidence by identifying subtle patterns in medical imaging and clinical data. Our solution offers a cost-effective alternative suitable for diverse clinical settings, particularly in resource-constrained environments. By integrating machine learning into clinical workflows, this research advances AI-driven diagnostics in oncology, laying the foundation for improved early detection of ovarian cancer. The model evaluation revealed that the random forest achieved an accuracy of 93%, decision tree attained 88.57%, and KNN reached 85.71%, demonstrating the effectiveness of our approach in early-stage ovarian cancer detection.

Financial fraud continues to threaten the integrity of digital financial systems, with traditional rule-based detection methods increasingly ineffective against evolving tactics. Recent advances suggest that integrating Machine Learning (ML) and Blockchain Technology may provide a robust solution. This study explores how this hybrid approach can improve fraud detection in financial transactions by enhancing accuracy, transparency, and response efficiency. The study adopted a quantitative research design using a publicly available dataset of over 2,500 financial transactions. Features included transaction amounts, account behavior, login attempts, and timestamps. Supervised machine learning models—Random Forest and Support Vector Machine (SVM)—were applied to classify transactions as fraudulent or legitimate. The models were trained, optimized, and evaluated using metrics such as accuracy, precision, recall, and F1-score. Descriptive analysis revealed fraud accounted for only 6.8% of transactions, confirming significant class imbalance. The Random Forest model outperformed the SVM, achieving 99.9% accuracy, precision, recall, and F1-score. TransactionAmount, TransactionDuration, and CustomerOccupation were found to be the most influential predictors. The integration of blockchain was identified as vital for secure, immutable data storage, enabling real-time auditability and enhancing the trustworthiness of the machine learning process. The combination of machine learning’s predictive power with blockchain’s immutable ledger creates a highly effective fraud detection framework. Random Forest was identified as the superior model in terms of both performance and reliability for this application. Financial institutions should adopt integrated ML-blockchain systems to strengthen fraud prevention, ensure transaction transparency, and support regulatory compliance. This study contributes to the advancement of intelligent and secure financial systems by offering empirical evidence of the value of this hybrid approach. Keywords: Fraud Detection, Machine Learning, Blockchain, Random Forest, Financial Transactions, Cybersecurity, Anomaly Detection.

In the recent research, Intrusion Detection sys- tem in Machine Learning has been giving good detection and high accuracy on novel attacks. The major purpose of this study is implementing a method that combines Random-Forest classification technique and K-Means clustering Algorithms. In misuse-detection, random-forest algorithm will build a patterns of intrusion over a training data. And in anomaly-detection, intrusions will be identified by the outlier-detection mechanism in the random-forest algorithm. This hybrid-detection system will combine the advantage of anomaly and mis-use detection and improves the performance of detection. This paper mainly focused on evaluating the performance of hybrid approaches namely Gaussian Mixture clustering with Random Forest Classifiers and K-Means clustering with Random Forest Classifiers in-order to detect intrusion. These algorithms were evaluated for the four categories of attacks based on accuracy, false-alarm-rate, and detection-rate. From our experiments conducted, K-Means clustering with Random Forest Classifiers outperformed over the Gaussian Mixture clustering with Random Forest Classifiers.

The rapid growth of Internet of Things (IoT) devices is accompanied by increasingly sophisticated security threats, including DDoS attacks, brute-force authentication attempts, and large-scale packet flooding. Traditional statistical methods for anomaly detection exhibit low robustness to noise and fail to account for the dynamic nature of IoT traffic. This results in a higher rate of false positives and reduced accuracy in attack identification. This paper proposes a hybrid approach to IoT traffic anomaly detection consisting of three stages: preliminary filtering of suspicious packets using a modified Z-score adjusted for sample size; adaptive probabilistic attack risk assessment based on a Bayesian classifier with a weighting function that amplifies the impact of significant deviations; final classification using an ensemble of models (Random Forest, SVM, and LSTM), which ensures robustness to noise and enables the identification of nonlinear dependencies in the data. Experimental evaluation on the UNSW-NB15 dataset, which includes both normal traffic and diverse attack scenarios, demonstrated that the proposed method achieved Precision = 89.1 %, Recall = 90.3 %, and F1-score = 89.9 %. The best results were observed in the analysis of message interval anomalies (up to 92 % accuracy), confirming the effectiveness of temporal features. The method outperformed classical algorithms (Rosner Test, Holt- Winters) and achieved comparable accuracy to autoencoder while requiring significantly fewer computational resources. The hybrid architecture enables adaptation to diverse attack types and reduces false alarms through the combination of statistical filtering and ensemble classification. Its noise resilience and low computational complexity make the method suitable for deployment in resource-constrained IoT environments. Future research directions include the integration of federated learning for decentralized anomaly detection and the use of self-adaptive neural architectures for predicting complex attack scenarios.

Data cleansing is an important prerequisite for reliable data evaluation and system-gaining knowledge of programs, directly impacting the exceptional insights and model overall performance. This paper provides a comprehensive examination of modern information-cleaning methodologies, focusing on their sensible packages and effectiveness across diverse datasets. We analyze six primary categories of information cleansing techniques: missing statistics management, outlier detection, information standardization, reproduction removal, consistency validation, and data type transformations. Our systematic assessment exhibits that automated information cleansing pipelines, at the same time efficient, require careful configuration primarily based on area context. Key findings imply that hybrid procedures—combining statistical techniques with area-precise policies—attain advanced consequences compared to standalone strategies, showing a 23% improvement in statistically satisfactory metrics. We also perceive that early-stage records validation significantly reduces downstream processing mistakes by 45%. The implications of this research suggest that companies ought to implement iterative facts-cleaning workflows, incorporating continuous validation and area expert remarks. Furthermore, our findings emphasize the significance of documenting cleansing decisions to ensure reproducibility and keep information lineage. This work offers a structured framework for practitioners to select and implement suitable facts-cleaning techniques based totally on their particular use cases and facts characteristics.

The popularity of smart speakers with virtual personal assistants such as Amazon Alexa and Google Assistant has been growing. However, the security and privacy of users using these devices have not been thoroughly examined which can lead to severe security and privacy concerns. In this poster, we present a fingerprinting attack of skills on Amazon Echo by analyzing the encrypted network traffic and show the potential privacy leakage of users using skills on smart speakers. Skills are voice applications that can be accessed through Amazon Alexa. Skills increase the diversity of using Amazon smart speakers by providing a variety of applications that can be used from a single platform with the use of voice commands without accessing a phone or a computer. In this fingerprinting attack, an adversary can eavesdrop on the network traffic of the smart speaker and predict the skill that is used by the user without decrypting the encrypted network traffic. For this attack, we collect the dataset consisting of 10,000 traces of encrypted network traffic related to 100 popular skills. We perform feature selection to investigate the top features that contribute to privacy leakage. We implement the attack by leveraging multiple machine learning algorithms. Among the different machine learning algorithms we implement, Random Forest Classifier performs the best by achieving an accuracy of 68.32% (compared to a random guess of 1%). The experimental results show that there is a need for developers to focus on the privacy leakages of users.

Although there are different techniques proposed for intrusion detection in the literature, most of them consider standalone misuse or anomaly intrusion detection systems.However, by taking the advantages of both systems a better hybrid intrusion detection system can be developed.In this paper, we present an effective hybrid layered intrusion detection system for detecting both previously known and zero-day attacks.In particular, a two layer system that combines misuse and anomaly intrusion detection systems is proposed.The first layer consists of misuse detector which can detect and block known attacks and the second layer comprises of anomaly detector which can efficiently detect and block previously unknown attacks.The misuse detector is modeled based on random forests classifier and the anomaly detector is built using bagging technique with ensemble of one-class support vector machine classifiers.Data pre-processing is done using automatic feature selection and data normalization.Experimental results show that the proposed intrusion detection system outperforms other well-known intrusion detection systems in detecting both previously known and zero-day attacks.

As reported by the United Nations in 2021, road accidents cause 1.3 million deaths and 50 million injuries worldwide each year. Detecting traffic anomalies timely and taking immediate emergency response and rescue measures are essential to reduce casualties, economic losses, and traffic congestion. This paper proposed a three-stage method for video-based traffic anomaly detection. In the first stage, the ViVit network is employed as a feature extractor to capture the spatiotemporal features from the input video. In the second stage, the class and patch tokens are fed separately to the segment-level and video-level traffic anomaly detectors. In the third stage, we finished the construction of the entire composite traffic anomaly detection framework by fusing outputs of two traffic anomaly detectors above with different granularity. Experimental evaluation demonstrates that the proposed method outperforms the SOTA method with 2.07% AUC on the TAD testing overall set and 1.43% AUC on the TAD testing anomaly subset. This work provides a new reference for traffic anomaly detection research.