Anomaly Detection in Network Security Logs Using Machine Learning

Network devices produce large volumes of security logs, and checking them by hand is slow. Signature-based tools work well against known attacks but can miss new ones. This paper builds an anomaly detection system for network security logs around the Isolation Forest algorithm, which is trained on normal records only and does not need labelled attacks. The system covers data loading, scaling, model training, anomaly scoring, performance evaluation, and a Flask web dashboard. Each record has three features: bytes sent, session duration, and failed logins. The experiments use a synthetic dataset of 1,000 records (950 normal and 50 anomalous). The models are trained on 760 normal records and tested on 240 records, made up of 190 normal records and all 50 anomalous ones. Isolation Forest is compared with Local Outlier Factor (LOF) and One-Class SVM using accuracy, precision, recall, and F1-score. All three models find every anomaly (recall of 1.00). Isolation Forest reaches an accuracy of 0.950 and an F1-score of 0.893 with 12 false alarms, LOF is slightly higher (F1-score 0.901), and One-Class SVM is slightly lower (0.870). The dashboard adds a sign-in page with approximate login location, and a risk score, risk level, possible incident type, and recommended action for each analysed log entry.