Real-Time Wi-Fi Network Traffic Anomaly Detection Using a Supervised Random Forest Model

The Wi-Fi Real-Time Anomaly Detection System is a machine-learning-based network security solution designed to monitor network traffic and identify abnormal or potentially malicious activities in real time. The system captures live network packets using Npcap and processes them using Scapy to construct network flows. From each flow, 68 network-flow features are extracted, representing characteristics such as packet counts, packet lengths, flow duration, inter-arrival times, protocol flags, and transmission rates. The extracted features are preprocessed using the same scaling and transformation pipeline applied during model development and are then provided to a Random Forest classifier for traffic classification. The system is developed using the CIC-IDS2017 dataset, which contains both benign and attack traffic. The training and evaluation data represent several attack categories, including PortScan, DDoS, DoS, FTP-Patator, SSH-Patator, Bot activity, Heartbleed, and web attacks. The V6 model classifies observed traffic into BENIGN or ATTACK categories. For real-time monitoring, the prediction results are continuously stored and displayed through a Streamlit dashboard, which provides Wi-Fi information, traffic statistics, source-wise summaries, live network flows, prediction confidence, and anomaly alerts. The proposed system can be applied in companies, colleges, and other organizational networks to continuously monitor traffic and provide an early indication of suspicious network behaviour. The system also supports controlled testing using labelled attack flows to demonstrate its anomaly-detection capability.