Comprehensive Analysis and Anomaly Detection of Network Traffic Using Isolation Forest Modeling

Abstract

Network traffic analysis is indeed in high value and importance, because analysis appears to our communication behavior, we can make better use of our web portal for the performance of what we are executing, additionally it helps us identify certain facilitates that can put our environment at a peculiar point for others to make attacks. The study gives an overview of a real use case network traffic captured using Wireshark and available in the excel file. The records include packet-level details such as timestamps, source and destination addresses, and protocols, and the packet lengths. First, we perform exploratory data analysis to capture the traffic behavior in terms of protocol distribution and variation in packet size, traffic metrics and communication characteristics. Temporal analysis has shown the highly bursty behavior of traffic and with the packet and byte rates changing in bursts over time. Next, traffic data are clustered into fixed time periods and converted into behavioral features that which encode packet counts, byte counts, and entropy of observed hosts. We use an unsupervised Isolation Forest model to detect abnormal traffic patterns to bypass labeled attack data. The model is able to identify abnormal time windows associated with extreme traffic spikes and abnormal communication patterns. We find that the integration of statistical traffic characterization and machine learning-based anomaly detection results in an efficient and scalable network monitoring and cybersecurity framework.