Anomalies Detection and Traffic Monitoring System in Computer Networks

The paper addresses the problem of anomaly detection in network traffic and proposes a comprehensive solution to enhance the level of cybersecurity for organizations of various scales. A comparative analysis of existing monitoring and anomaly detection systems has been carried out, including both open-source solutions and commercial products. Based on the conducted research, the technological stack for implementing a network traffic anomaly detection system has been justified, particularly the optimal combination of Python libraries for collecting and processing network traffic, data preparation, applying machine learning algorithms, and visualizing the results. A fully functional system consisting of five main components has been developed: a network traffic collection module based on PyShark, a packet processing service for flow aggregation, an anomaly detection module using machine learning algorithms, an API module based on FastAPI, and a user web interface developed in React. The system ensures high accuracy in detecting potential threats, optimized use of computational resources, and convenient analysis of the network state. An experimental study was conducted on the UNSW-NB15 dataset, which contains over 2.5 million records of network connections. A comparative analysis of three machine learning algorithms was performed: Random Forest, Support Vector Machine, and Logistic Regression. Random Forest demonstrated the best results with 94% accuracy on the test set and an area under the ROC curve of 0.99, significantly outperforming the alternative algorithms. A key feature of the proposed approach is the integration of machine learning methods with comprehensive analysis of various network traffic parameters, which significantly improves anomaly detection accuracy and minimizes the number of false positives compared to existing solutions.