Home / Current Issue / Paper 1723940
Real-Time Wi-Fi Network Traffic Anomaly Detection Using a Supervised Random Forest Model
Subject area: Science,Engineering and Technology · Area of research: Cyber Security, Machine Learning Algorithms
DOI: 10.64388/IREV10I4-1723940
Abstract
The Wi-Fi Real-Time Anomaly Detection System is a machine-learning-based network security solution designed to monitor network traffic and identify abnormal or potentially malicious activities in real time. The system captures live network packets using Npcap and processes them using Scapy to construct network flows. From each flow, 68 network-flow features are extracted, representing characteristics such as packet counts, packet lengths, flow duration, inter-arrival times, protocol flags, and transmission rates. The extracted features are preprocessed using the same scaling and transformation pipeline applied during model development and are then provided to a Random Forest classifier for traffic classification. The system is developed using the CIC-IDS2017 dataset, which contains both benign and attack traffic. The training and evaluation data represent several attack categories, including PortScan, DDoS, DoS, FTP-Patator, SSH-Patator, Bot activity, Heartbleed, and web attacks. The V6 model classifies observed traffic into BENIGN or ATTACK categories. For real-time monitoring, the prediction results are continuously stored and displayed through a Streamlit dashboard, which provides Wi-Fi information, traffic statistics, source-wise summaries, live network flows, prediction confidence, and anomaly alerts. The proposed system can be applied in companies, colleges, and other organizational networks to continuously monitor traffic and provide an early indication of suspicious network behaviour. The system also supports controlled testing using labelled attack flows to demonstrate its anomaly-detection capability.
Keywords
Wi-Fi security; anomaly detection; Random Forest; network traffic monitoring
References
[1] Gowda M, Abhishek BS, Kumar V, Manjunatha N, Nandakumar. Wi-Fi traffic anomaly detection using Isolation Forest algorithm. Iconic Research and Engineering Journals. 2026;9(10):452–453.
[2] Alauthman A, Shraa T. Deep reinforcement learning-driven dynamic spectrum access in dense Wi-Fi environments. IEEE Access. 2025;13:178663–178690. https://doi.org/10.1109/ACCESS.2025.3621489
[3] Tao X, Peng Y, Zhao F, Zhao P, Wang Y. A parallel algorithm for network traffic anomaly detection based on Isolation Forest. International Journal of Distributed Sensor Networks. 2018;14(11). https://doi.org/10.1177/1550147718814471
[4] El Alami H, Rawat DB. IDS-Twin: Digital twin-based intrusion detection systems for wireless networks. IEEE Networking Letters. 2025;7(4):255–259. https://doi.org/10.1109/LNET.2025.3606789
[5] Liu FT, Ting KM, Zhou ZH. Isolation forest. In: Proceedings of the 8th IEEE International Conference on Data Mining; 2008; Pisa, Italy. p. 413–422. https://doi.org/10.1109/ICDM.2008.17
[6] Xu H, Pang G, Wang Y, Wang Y. Deep isolation forest for anomaly detection. arXiv:2206.06602 [Preprint]. 2022.
How to cite this paper
@article{1723940,
author = {Manish M Gowda, Abhishek BS, Manjunatha N, Gowdra Vijay Kumar, Nandakumar},
title = {Real-Time Wi-Fi Network Traffic Anomaly Detection Using a Supervised Random Forest Model},
journal = {Iconic Research And Engineering Journals},
year = {2026},
volume = {10},
number = {4},
pages = {1909-1915},
issn = {2456-8880},
url = {https://www.irejournals.com/formatedpaper/1723940.pdf},
abstract = {The Wi-Fi Real-Time Anomaly Detection System is a machine-learning-based network security solution designed to monitor network traffic and identify abnormal or potentially malicious activities in real time. The system captures live network packets using Npcap and processes them using Scapy to construct network flows. From each flow, 68 network-flow features are extracted, representing characteristics such as packet counts, packet lengths, flow duration, inter-arrival times, protocol flags, and transmission rates. The extracted features are preprocessed using the same scaling and transformation pipeline applied during model development and are then provided to a Random Forest classifier for traffic classification. The system is developed using the CIC-IDS2017 dataset, which contains both benign and attack traffic. The training and evaluation data represent several attack categories, including PortScan, DDoS, DoS, FTP-Patator, SSH-Patator, Bot activity, Heartbleed, and web attacks. The V6 model classifies observed traffic into BENIGN or ATTACK categories. For real-time monitoring, the prediction results are continuously stored and displayed through a Streamlit dashboard, which provides Wi-Fi information, traffic statistics, source-wise summaries, live network flows, prediction confidence, and anomaly alerts. The proposed system can be applied in companies, colleges, and other organizational networks to continuously monitor traffic and provide an early indication of suspicious network behaviour. The system also supports controlled testing using labelled attack flows to demonstrate its anomaly-detection capability.},
keywords = {Wi-Fi security; anomaly detection; Random Forest; network traffic monitoring},
month = {October},
doi = {https://doi.org/10.64388/IREV10I4-1723940}
}