Machine Learning Techniques for Detecting Anomalies in Network Traffic

Abstract

This study examines how machine learning methods can be applied to identify anomalies in network traffic, an essential aspect of contemporary cybersecurity. With the increasing complexity and scale of digital networks, traditional methods of detecting irregular behaviour have become inadequate, highlighting the need for more adaptable and intelligent detection systems. The research evaluates a variety of machine learning techniques, including supervised models like Decision Trees and Support Vector Machines, unsupervised algorithms such as k-Means and Isolation Forests, as well as hybrid approaches, to detect patterns that could signal cyber threats. Using publicly available datasets like CICIDS2017, the study focuses on critical aspects such as data cleaning, feature extraction, and model tuning to improve the reliability of the detection process. Performance is assessed through the metrics: accuracy, precision, recall, and F1 score. The findings demonstrate that ensemble methods and deep learning architectures, particularly hybrid CNN-LSTM models, perform best in identifying complex network anomalies while addressing challenges like false alarms and the adaptation of network traffic over time. This work contributes to the development of scalable, interpretable, and real-time methods for anomaly detection, strengthening network defenses against evolving cybersecurity risks.