Architectural framework of a prototype for anomaly detection in network traffic using machine learning

Abstract

This paper presents a prototype application for detecting network traffic anomalies by integrating visual analytics and unsupervised machine learning. Built using a Flask-based three-tier architecture, the system employs the Isolation Forest algorithm for anomaly detection and provides interactive web-based visualizations to enhance human interpretation of complex traffic patterns. Key features include temporal traffic flow visualization, protocol distribution analysis, and anomaly severity classification. The prototype enables network administrators to identify sophisticated intrusions through real-time metrics and supports informed decision making for threat mitigation.