Behaviour-Based Machine Learning Framework for Detecting Anomalous Network Activities

This paper proposes a behaviour-based machine learning framework for detecting anomalous network activities. By combining behavioural feature extraction, Isolation Forest, Autoencoder, Random Forest, adaptive thresholding, and interpretable alerts, the framework aims to address limitations of conventional signature-based intrusion detection systems. The proposed research will evaluate the framework using established network intrusion datasets and standard performance metrics. The findings are expected to contribute to the development of more adaptive, interpretable, and effective network anomaly detection systems.

[1] M. A. A. K. A. et al., “A Review on Machine Learning Approaches for Network Malicious Behavior Detection in Emerging Technologies,” [Journal article], 2021. [Online]. Available: https://pmc.ncbi.nlm.nih.gov/articles/PMC8145138/ [2] “Flow-Level Statistical Fingerprinting for Unsupervised Network Intrusion Detection,” Lusófona University Research Repository. [Online]. Available: https://research.ulusofona.pt/en/publications/flow-level-statistical-fingerprinting-for-unsupervised-network-in/ [3] S. Choi, S. Kim, and J. Ryu, “A Survey of Deep Learning-Based Network Anomaly Detection: Benchmarking on NSL-KDD, UNSW-NB15, and CICIDS2017,” IEIE Transactions on Smart Processing and Computing, vol. 15, no. 3, pp. 410–425, 2026, doi: 10.5573/IEIESPC.2026.15.3.410. [4] N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems,” in 2015 Military Communications and Information Systems Conference (MilCIS), 2015. [5] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proceedings of the International Conference on Information Systems Security and Privacy (ICISSP), 2018, pp. 108–116.