The proliferation of interconnected devices within organizational networks has created a vast and dynamic attack surface, yet many small to medium-sized enterprises (SMEs) lack the resources for continuous and intelligent security monitoring. Existing vulnerability scanners often require manual operation and fail to detect behavioral anomalies that may indicate an emerging threat. This paper presents Aegis, a fully automated system that integrates network vulnerability scanning with unsupervised, behavior-based anomaly detection. Built on a scalable Django and Celery architecture, Aegis performs automated device discovery, parallelized service scanning, and matches discovered software against the National Vulnerability Database (NVD) for known Common Vulnerabilities and Exposures (CVEs). The core contribution is a longitudinal analysis engine that applies the Isolation Forest algorithm to a 12-dimensional feature vector derived from each device's scan history. By maintaining a rolling baseline across the five most recent scans per device, the system detects subtle anomalous behaviors — including new service emergence, port activity spikes, and shifts in vulnerability posture — and delivers scan-triggered alerts to administrators.
Kapadiya et al. (Sat,) studied this question.