Real-Time Wi-Fi Network Traffic Anomaly Detection Using a Supervised Random Forest Model

1Introduction

The implementation integrates real-time packet capture, flow construction, 68-feature extraction, preprocessing, Random Forest classification, and Streamlit visualization for continuous Wi-Fi anomaly detection. Our earlier study investigated Wi-Fi traffic anomaly detection using the Isolation Forest approach [1]. Building upon that work, the present study focuses on the implementation and evaluation of the developed network traffic anomaly detection pipeline. The present implementation incorporates packet capture using Npcap and Scapy, flow construction, a fixed 68-feature representation, stored preprocessing, supervised classification, real-time logging, and a Streamlit-based monitoring interface. Isolation Forest is attractive for a lightweight prototype because it is an unsupervised method based on recursive random partitioning. The original method showed that anomalous observations tend to be isolated with shorter path lengths [5].

2Related work

2.1Wireless conditions and the base paper

The principal base paper, published in IEEE Access in 2025, investigates dynamic spectrum access in dense Wi-Fi environments using deep reinforcement learning. It models multiple access points and heterogeneous traffic in an NS-3 environment and uses environmental observations such as interference, traffic load, delay, and signal-related information for dynamic channel decisions [2].

2.2Network anomaly detection

Tao et al. proposed a parallel network-traffic anomaly detection method based on Isolation Forest and Spark for large-scale traffic processing [3].

2.3Adaptive wireless IDS

IDS-Twin moves wireless intrusion detection toward streaming and self-adaptive anomaly modelling using a digital-twin-based replay environment and contrastive learning [4].

3Implementation

3.1Packet capture and traffic collection

The Phase-2 system was implemented in a Windows environment for real-time observation of Wi-Fi network traffic. Npcap was used to capture packets from the selected wireless interface, while Scapy was used for packet processing. The captured traffic was continuously monitored and converted into flow-level information for subsequent analysis.

3.2Flow construction

Captured packets were grouped into network flows instead of being analysed individually. Each flow records communication characteristics such as source and destination information, ports, transport protocol, duration, packet count, and related traffic statistics. This flow-based representation enables temporal and directional properties of network communication to be considered during detection.

3.3Feature extraction and preprocessing

Each constructed flow was converted into a fixed 68-feature representation. The features include packet and byte counts, packet-length statistics, inter-arrival-time characteristics, transport flags, directional rates, subflow statistics, and active/idle measurements. The extracted feature vector was passed through the stored preprocessing pipeline before classification.

3.4Machine learning classification

The preprocessed flow features were provided to the trained Random Forest classifier, which generated a binary BENIGN or ATTACK decision along with its confidence. The binary classification provides a direct indication of whether the observed flow resembles the traffic patterns learned during model training.

4Results and performance evaluation

4.1Experimental setup

The developed Phase-2 system was evaluated using a supervised machine-learning approach for network-flow classification. Unlike an unsupervised anomaly scoring approach, the V6 model was trained to distinguish normal network behaviour from traffic patterns associated with malicious activity. The final V6 feature set consists of 68 numerical network-flow attributes. These attributes describe multiple characteristics of a

communication flow, including packet counts, packet lengths, flow duration, inter-arrival times, transmission rates, TCP flags, header information, window sizes, and active/idle behaviour. Before classification, the selected features are subjected to the same preprocessing pipeline used during model development. Logarithmic transformation is applied to appropriate traffic-rate features, followed by feature scaling. The resulting feature vector is then supplied to the trained Random Forest classifier.

For independent evaluation, a separate Tuesday traffic dataset containing 445,909 records was used. The dataset consisted of 432,074 BENIGN flows, 7,938 FTP-Patator flows, and 5,897 SSH-Patator flows. No feature mismatch occurred during testing, as all 68 features expected by the V6 model were available in the independent dataset.

4.2Classification performance

The proposed Random Forest classifier achieved the performance shown in Table 1 on the independent Tuesday test data.

Metric	Proposed system performance
Accuracy	99.99%
Precision	99.65%
Recall	100.00%
F1-Score	99.82%

The high recall indicates that the evaluated attack flows were successfully identified by the classifier. The precision value also indicates that only a small number of normal flows were incorrectly classified as malicious. The overall accuracy was approximately 99.99%, demonstrating strong classification performance on the independent evaluation set.

4.3Confusion matrix analysis

Table 2 gives the binary confusion matrix obtained in the Tuesday evaluation.

Actual / Predicted	BENIGN	ATTACK
BENIGN	432,025	49
ATTACK	0	13,835

The classifier correctly identified 432,025 benign flows and 13,835 attack flows. Only 49 benign flows were incorrectly classified as attacks, while no attack flows in this test set were classified as benign.

4.4Attack-wise detection performance

The independent test also enabled evaluation of the two attack classes present in the Tuesday test set (Table 3).

Attack type	Total samples	Detected	Detection Rate
FTP-Patator	7,938	7,938	100%
SSH-Patator	5,897	5,897	100%

Both FTP-Patator and SSH-Patator traffic were successfully detected in the independent evaluation. The result demonstrates that the learned network-flow patterns were effective for the attack categories represented in this test set.

4.5Dashboard output

A real-time monitoring dashboard was developed using Streamlit to display the active Wi-Fi network information, including SSID, signal strength, channel, frequency band, and transmission rates, together with live network traffic statistics and anomaly detection results.

Field	Meaning
Source_IP	IP address involved in the observed traffic
Flows	Number of network flows associated with that IP
Attacks	Number of those flows classified as attacks
Normal	Number classified as normal
Status	Overall status based on the detection results

Column	Meaning
Time	When the network flow was observed
Source_IP	Device/source generating the traffic
Source_Port	Port used by the source
Destination_IP	Remote/local destination
Destination_Port	Destination service port
Protocol	17 = UDP, 6 = TCP
Duration	Duration of that flow in seconds
Packets	Number of packets in the flow
Prediction	Our model's classification
Confidence	Model confidence
Status	Human-readable result: NORMAL or ATTACK

4.6Flow features

The main flow features are computed as follows:

where $N_f$ and $N_b$ are the numbers of packets travelling in the forward and backward directions. The total forward and backward bytes are

where $L_i$ ($L_j$) is the length of the $i$th forward ($j$th backward) packet, and $t_1$ and $t_n$ are the times of the first and last packets of the flow.

5Conclusion

The proposed system provides an effective approach for real-time network anomaly detection using 68 flow-level features and a Random Forest classifier. The system successfully combines live traffic monitoring with machine-learning-based classification and a user-friendly dashboard. The results demonstrate its potential for practical network-security monitoring. Future work can focus on detecting additional attack types and improving real-time deployment across larger networks.

References

1. [1]Gowda M, Abhishek BS, Kumar V, Manjunatha N, Nandakumar. Wi-Fi traffic anomaly detection using Isolation Forest algorithm. Iconic Research and Engineering Journals. 2026;9(10):452–453.
2. [2]Alauthman A, Shraa T. Deep reinforcement learning-driven dynamic spectrum access in dense Wi-Fi environments. IEEE Access. 2025;13:178663–178690. https://doi.org/10.1109/ACCESS.2025.3621489
3. [3]Tao X, Peng Y, Zhao F, Zhao P, Wang Y. A parallel algorithm for network traffic anomaly detection based on Isolation Forest. International Journal of Distributed Sensor Networks. 2018;14(11). https://doi.org/10.1177/1550147718814471
4. [4]El Alami H, Rawat DB. IDS-Twin: Digital twin-based intrusion detection systems for wireless networks. IEEE Networking Letters. 2025;7(4):255–259. https://doi.org/10.1109/LNET.2025.3606789
5. [5]Liu FT, Ting KM, Zhou ZH. Isolation forest. In: Proceedings of the 8th IEEE International Conference on Data Mining; 2008; Pisa, Italy. p. 413–422. https://doi.org/10.1109/ICDM.2008.17
6. [6]Xu H, Pang G, Wang Y, Wang Y. Deep isolation forest for anomaly detection. arXiv:2206.06602 [Preprint]. 2022.