ADTreal: Decision Tree-Based Real-Time Network Traffic Anomaly Detection with Cloud Deployment for Enhanced Cyber Security

Abstract

In the realm of contemporary network security, the ongoing advancement of cyber threats necessitates creative methods for identifying anomalies in real-time network traffic. This study explores the application of machine learning models within network security, with a specific emphasis on comparing three models: Decision Trees, KNN, and logistic regression. The analysis, referred to as ADTreal, focuses on the binary classification of normal versus anomalous network traffic utilizing a Kaggle dataset, investigating the intricacies of model training, real-time testing, and cloud environment deployment. The most suitable Decision Tree model undergoes careful training and hyperparameter optimization, demonstrating superior performance during comparative evaluations. Real-time testing involves the live capture of network packets, feature extraction, and the seamless integration of the model for swift anomaly detection. A crucial element is the deployment of the Decision Tree model within the Amazon Web Services (AWS) Elastic Compute Cloud (EC2) framework.  The serialized model, transferred to an EC2 instance, runs for real-time predictions, highlighting the practicality and benefits of cloud-based solutions for enhancing network security. Evaluation metrics such as accuracy, precision, recall, and F1 score provide insights into the effectiveness of the Decision Tree model. The accompanying confusion matrix analysis further clarifies its capability to distinguish between normal and anomalous traffic in real time. The culmination of this research underscores the importance of real-time anomaly detection and the viability of implementing machine learning models in cloud settings, thereby strengthening the foundations of secure network infrastructures in the face of evolving cyber threats.